Adaptive Images Vulnerabilities

The Adaptive Images plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘REQUEST_URI’ in versions up to, and including, 0.6.68 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i...

CVSS:

6.1

Affected:

up to 0.6.68

Fixed in:

0.6.69

Disclosed:

Jan 11, 2022

Reflected Cross-Site Scripting (XSS) vulnerability discovered by Jan w Oleju in WordPress Adaptive Images for WordPress plugin (versions <= 0.6.68).

Affected:

up to 0.6.69

Fixed in:

0.6.69

Disclosed:

Jan 11, 2022

The Adaptive Images plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘REQUEST_URI’ in versions up to, and including, 0.6.68 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute i...

Affected:

up to 0.6.69

Fixed in:

0.6.69

Disclosed:

Jan 11, 2022

[en] A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php.

Affected:

up to 0.6.67

Fixed in:

0.6.67

Disclosed:

Jul 21, 2019

CVE-2019-14205 on NVD →

[en] An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via the $REQUEST['adaptive-images-settings'] parameter in adaptive-images-script.php.

Affected:

up to 0.6.67

Fixed in:

0.6.67

Disclosed:

Jul 21, 2019

CVE-2019-14206 on NVD →

An Arbitrary File Deletion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to delete arbitrary files via the $REQUEST['adaptive-images-settings'] parameter in adaptive-images-script.php.

CVSS:

7.5

Affected:

up to 0.6.67

Fixed in:

0.6.67

Disclosed:

Jul 19, 2019

CVE-2019-14206 on NVD →

A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php.

CVSS:

7.5

Affected:

up to 0.6.67

Fixed in:

0.6.67

Disclosed:

Jul 19, 2019

CVE-2019-14205 on NVD →

The plugin does not sanitise and escape the REQUEST_URI before outputting it back in a page, leading to a Reflected Cross-Site Scripting issue

Affected:

up to 0.6.69

Fixed in:

0.6.69