Vulnerabilities and security researches forresmushit-image-optimizer

CVE, Research URL: CVE-2022-2450
Home page URL: Security reports for reSmush.it : The original free image compressor and optimizer plugin
Application: reSmush.it : The original free image compressor and optimizer plugin
Date: Nov 14, 2022
Research Description: The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, allowing any logged-in users, such as subscribers to call them.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2022-2448
Home page URL: Security reports for reSmush.it : The original free image compressor and optimizer plugin
Application: reSmush.it : The original free image compressor and optimizer plugin
Date: Oct 11, 2022
Research Description: The reSmush.it WordPress plugin before 0.4.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when unfiltered_html is disallowed.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2022-2449
Home page URL: Security reports for reSmush.it : The original free image compressor and optimizer plugin
Application: reSmush.it : The original free image compressor and optimizer plugin
Date: Nov 14, 2022
Research Description: The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.
Affected versions: Min -, max -.
Status: vulnerable

Vulnerabilities and security researches forresmushit-image-optimizer resmushit-image-optimizer