99 matches found
CVE-2026-81285
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization = 4.2.0 versions...
EUVD-2026-67728
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization = 4.2.0 versions...
CVE-2026-81285 WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization = 4.2.0 versions...
CVE-2026-81285
Smush Image Compression and Optimization is a WordPress plugin affected by an unauthenticated Denial of Service vulnerability in versions ≤ 4.2.0 . The flaw allows a remote, unauthenticated attacker to trigger a denial of service over the network with low complexity and no user interaction requir...
CVE-2026-19223
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...
CVE-2026-19223
The Smush WordPress plugin (Image Compression and Optimization) before 4.3.2 contains an Admin+ Network-Wide RCE vulnerability in its Hub Connector component, discovered by Jakub Herman . A network-wide setting is not restricted to network administrators , allowing an administrator of any single ...
WordPress Smush plugin < 4.3.2 - Admin+ Network-Wide RCE vulnerability
Admin+ Network-Wide RCE vulnerability discovered by Jakub Herman in WordPress Plugin Smush Image Compression and Optimization versions 4.3.2...
CVE-2026-19223 Smush < 4.3.2 - Admin+ Network-Wide RCE via Hub Connector on Multisite
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...
EUVD-2026-66873
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network...
CVE-2026-2712
The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the receiveheartbeat function in includes/class-wp-optimize-heartbeat.php in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly...
EUVD-2026-21254
The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the receiveheartbeat function in includes/class-wp-optimize-heartbeat.php in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly...
CVE-2026-2712
The connected document identifies CVE-2026-2712-related risk in WordPress WP-Optimize plugin, specifically versions <= 4.5.0. The vulnerability is described as Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation, meaning an authenticated user with...
CVE-2026-2712
The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the receiveheartbeat function in includes/class-wp-optimize-heartbeat.php in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly...
CVE-2026-2712 WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation
The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the receiveheartbeat function in includes/class-wp-optimize-heartbeat.php in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly...
CVE-2026-2712 WP-Optimize <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update and Image Manipulation
The WP-Optimize plugin for WordPress is vulnerable to unauthorized access of functionality due to missing capability checks in the receiveheartbeat function in includes/class-wp-optimize-heartbeat.php in all versions up to, and including, 4.5.0. This is due to the Heartbeat handler directly...
PT-2026-31845
Name of the Vulnerable Software and Affected Versions WP-Optimize plugin for WordPress versions up to and including 4.5.0 Description The WP-Optimize plugin for WordPress has a flaw that allows unauthorized access to functionality. This is due to missing capability checks in the receive heartbeat...
CVE-2025-22288
Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a through = 3.17.0...
CVE-2025-22288
Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a through = 3.17.0...
CVE-2025-22288 WordPress Smush Image Compression and Optimization plugin <= 3.17.0 - Directory Traversal vulnerability
Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a through = 3.17.0...
EUVD-2025-38034
Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a through = 3.17.0...