WordPress WebP Converter for Media < 4.0.3 - Unauthenticated Open Redirect

WordPress WebP Converter for Media 4.0.3 contains a file passthru.php which does not validate the src parameter before redirecting the user to it, leading to an open redirect issue. id: CVE-2021-25074 info: name: WordPress WebP Converter for Media 4.0.3 - Unauthenticated Open Redirect author:...

CVE-2026-110635

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell...

CVE-2026-110635 webp-converter before 3.0.0 OS Command Injection via File Names and Options

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell...

CVE-2026-110635

The webp-converter library, in versions prior to 3.0.0 , is susceptible to an OS command injection vulnerability within the src/webpconverter.js helpers. The root cause is the use of execFile with shell enabled to run libwebp binaries. Attackers who can control file names or option strings passed...

EUVD-2026-101263

webp-converter before 3.0.0 contains an OS command injection vulnerability in src/webpconverter.js helpers that run libwebp binaries via execFile with shell enabled. Attackers controlling file names or option strings passed to cwebp, dwebp, gwebp, or webpmux functions can inject shell...

CVE-2026-1319: Improper Neutralization of Input During Web Page Generation

The Robin Image Optimizer – Unlimited Image Optimization & WebP Converter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'Alternative Text' field of a Media Library image in all versions up to, and including, 2.0.2 due to insufficient input sanitization and output...

PT-2025-51816

Name of the Vulnerable Software and Affected Versions The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress versions up to and including 6.3.2 Description The plugin is susceptible to unauthorized data modification because of a missing capability check on the...

EUVD-2021-11986

Malware in sbrugna...

EUVD-2019-6751

Malware in sbrugna...

CVE-2021-25074

The WebP Converter for Media WordPress plugin before 4.0.3 contains a file passthru.php which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue...

WordPress WebP Converter for Media plugin input validation error vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL.The WordPress plugin WebP Converter for Media prior to version 4.0.3 is vulnerable to an input validation...

WordPress WebP Converter for Media Plugin < 4.0.3 Open Redirect Vulnerability

The WordPress plugin Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-25074

The WebP Converter for Media WordPress plugin before 4.0.3 contains a file passthru.php which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue...

CVE-2021-25074

The WebP Converter for Media WordPress plugin before 4.0.3 contains a file passthru.php which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue...

CVE-2021-25074

The WebP Converter for Media WordPress plugin before 4.0.3 contains a file passthru.php which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue...

Open redirect

The WebP Converter for Media WordPress plugin before 4.0.3 contains a file passthru.php which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue...

CVE-2021-25074 WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect

The WebP Converter for Media WordPress plugin before 4.0.3 contains a file passthru.php which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue...

CVE-2021-25074

The CVE-2021-25074 entry refers to the WordPress WebP Converter for Media plugin prior to version 4.0.3, where the passthru.php file does not validate the src parameter before redirecting, causing an Unauthenticated Open Redirect. The vulnerability affects the plugin’s WordPress integration and c...

PT-2022-9630

Name of the Vulnerable Software and Affected Versions WebP Converter for Media WordPress plugin versions prior to 4.0.3 Description The issue arises from a file named passthru.php that fails to validate the src parameter before redirecting the user to it, resulting in an Open Redirect issue...

CVE-2021-25074: URL Redirection to Untrusted Site

The WebP Converter for Media WordPress plugin before 4.0.3 contains a file passthru.php which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue...