Vulnerabilities and security researches forwp-compress-image-optimizer wp-compress-image-optimizer
Direction: ascendingJun 07, 2024
WP Compress – Image Optimizer [All-In-One] # CVE-2023-6812
- CVE, Research URL
- Application
- Date
- May 14, 2024
- Research Description
- The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to insufficient validation on the redirect url supplied via the 'css' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
WP Compress – Image Optimizer [All-In-One] # CVE-2024-1934
- CVE, Research URL
- Application
- Date
- Apr 10, 2024
- Research Description
- The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wps_local_compress::__construct' function in all versions up to, and including, 6.11.10. This makes it possible for unauthenticated attackers to reset the CDN region and set a malicious URL to deliver images.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
WP Compress – Image Optimizer [All-In-One] # CVE-2023-6699
- CVE, Research URL
- Application
- Date
- Jan 11, 2024
- Research Description
- The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
WP Compress – Image Optimizer [All-In-One] # CVE-2024-4445
- CVE, Research URL
- Application
- Date
- May 14, 2024
- Research Description
- The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to, and including, 6.20.01. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit plugin settings, including storing cross-site scripting, in multisite environments.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
WP Compress – Image Optimizer [All-In-One] # CVE-2024-32106
- CVE, Research URL
- Application
- Date
- Apr 11, 2024
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in WP Compress WP Compress – Image Optimizer [All-In-One].This issue affects WP Compress – Image Optimizer [All-In-One]: from n/a through 6.10.35.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Oct 03, 2024
WP Compress – Image Optimizer [All-In-One] # CVE-2024-47384
- CVE, Research URL
- Application
- Date
- Oct 05, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Compress WP Compress – Image Optimizer [All-In-One] allows Reflected XSS.This issue affects WP Compress – Image Optimizer [All-In-One]: from n/a through 6.20.13.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Jan 05, 2025
WP Compress – Image Optimizer [All-In-One] # CVE-2024-12047
- CVE, Research URL
- Application
- Date
- Jan 04, 2025
- Research Description
- The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Mar 26, 2025
WP Compress – Image Optimizer [All-In-One] # CVE-2025-2109
- CVE, Research URL
- Application
- Date
- Mar 25, 2025
- Research Description
- The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
Mar 27, 2025
WP Compress – Image Optimizer [All-In-One] # CVE-2025-2110
- CVE, Research URL
- Application
- Date
- Mar 26, 2025
- Research Description
- The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin’s functionality, and potentially impacting overall site performance.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable
May 09, 2025
WP Compress – Image Optimizer [All-In-One] # CVE-2025-47546
- CVE, Research URL
- Application
- Date
- May 07, 2025
- Research Description
- Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress allows Cross Site Request Forgery. This issue affects WP Compress: from n/a through 6.30.30.
- Affected versions
-
Min -, max -.
- Status
-
vulnerable