Resmushit Image Optimizer Vulnerabilities

The reSmush.it Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.4.6. This is due to missing or incorrect nonce validation on several AJAX calls. This makes it possible for unauthenticated attackers to invoke those functions to do things like process im...

CVSS:

8.8

Affected:

up to 0.4.6

Fixed in:

0.4.7

Disclosed:

Oct 26, 2022

CVE-2022-2449 on NVD →

The reSmush.it plugin for WordPress is vulnerable to Stored Cross-Site Scripting via some of its settings parameters in versions up to, and including, 0.4.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to...

CVSS:

5.5

Affected:

up to 0.4.5

Fixed in:

0.4.6

Disclosed:

Sep 19, 2022

CVE-2022-2448 on NVD →

The reSmush.it plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several AJAX actions in versions up to, and including, 0.4.3 . This makes it possible for unauthenticated attackers to download the logs of the plugin which can contain sensitive information.

CVSS:

7.3

Affected:

up to 0.4.3

Fixed in:

0.4.4

Disclosed:

Aug 11, 2022

CVE-2022-2450 on NVD →