CVE-2026-6295

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...

CVE-2026-6295 WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...

CVE-2026-6295

WP Optimizer (WordPress plugin) is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0 . The root cause is an unsafe subquery-detection branch in the Query::parse_key_compare_field() method: when a user-supplied value matches the regex ^[(\s]*SELECT\s+, it ...

EUVD-2026-83544

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...

CVE-2026-6295 WP Optimizer <= 2.5.0 - Authenticated (Administrator+) SQL Injection via 's' Parameter

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...

PT-2026-95790

Name of the Vulnerable Software and Affected Versions WP Optimizer versions prior to 2.5.1 Description Authenticated attackers with administrator-level access can perform SQL Injection through the 's' parameter. The issue occurs in the parse key compare field function of the Query class, where a...

CVE-2026-6295: Improper Neutralization of Special Elements used in an SQL Command

The WP Optimizer plugin for WordPress is vulnerable to SQL Injection via the 's' parameter in all versions up to and including 2.5.0. This is due to an unsafe subquery-detection branch in the Query::parsekeycomparefield method that, when the user-supplied value matches the regex ^\sSELECT\s+, wra...

WordPress WP Optimizer – PageSpeed, Cache, Minify & Core Web Vitals plugin <= 2.5.0 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by san6051 in WordPress Plugin WP Optimizer versions = 2.5.0...

EUVD-2025-9869

Malicious code in bioql PyPI...

EUVD-2025-8585

Malicious code in bioql PyPI...

CVE-2025-53314

Cross-Site Request Forgery CSRF vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through = 2.5.0...

CVE-2025-53314

Cross-Site Request Forgery CSRF vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through = 2.5.0...

CVE-2025-53314

CVE-2025-53314 describes a Cross-Site Request Forgery (CSRF) in the WordPress plugin WP Optimizer (sh1zen) affecting versions up to 2.3.6. The entry notes that the CSRF vulnerability enables SQL injection. The CVSS vector indicates Network attack, no privileges required, user interaction required...

CVE-2025-53314 WordPress WP Optimizer plugin <= 2.3.6 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in sh1zen WP Optimizer allows SQL Injection. This issue affects WP Optimizer: from n/a through 2.3.6...

CVE-2025-53314 WordPress WP Optimizer plugin <= 2.5.0 - Cross Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through = 2.5.0...

PT-2025-27212 · WordPress · Sh1Zen Wp Optimizer

Name of the Vulnerable Software and Affected Versions: sh1zen WP Optimizer versions 2.3.6 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows SQL Injection. Recommendations: For sh1zen WP Optimizer versions 2.3.6 and earlier, update to a version later...

WordPress plugin WP Optimizer 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request...

CVE-2025-53314: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in sh1zen WP Optimizer wp-optimizer allows SQL Injection.This issue affects WP Optimizer: from n/a through = 2.5.0...

CVE-2025-32147

Missing Authorization vulnerability in coothemes Easy WP Optimizer easy-wp-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy WP Optimizer: from n/a through = 1.1.0...

CVE-2025-32147

Missing Authorization vulnerability in coothemes Easy WP Optimizer easy-wp-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy WP Optimizer: from n/a through = 1.1.0...