Image Optimizer
Monthly
OS command injection in the image_optimizer Ruby gem versions 1.3.0 through 1.9.0 allows unauthenticated remote attackers to execute arbitrary shell commands with the privileges of the Ruby process by supplying an image path containing shell metacharacters such as ';'. The flaw is reachable only when the consuming application enables the 'identify' option (so that ImageOptimizer#identify_format runs) and the attacker controls the image path argument, typically through an attacker-chosen uploaded file name, which means real-world impact is bounded by the OS privileges of the Ruby/web worker process and by whether user-controlled filenames reach the gem. The CVSS 4.0 base score of 9.3 reflects high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis; the included gist and VulnCheck advisory serve as the primary public technical disclosures.
Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.6.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 60.2%.
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
OS command injection in the image_optimizer Ruby gem versions 1.3.0 through 1.9.0 allows unauthenticated remote attackers to execute arbitrary shell commands with the privileges of the Ruby process by supplying an image path containing shell metacharacters such as ';'. The flaw is reachable only when the consuming application enables the 'identify' option (so that ImageOptimizer#identify_format runs) and the attacker controls the image path argument, typically through an attacker-chosen uploaded file name, which means real-world impact is bounded by the OS privileges of the Ruby/web worker process and by whether user-controlled filenames reach the gem. The CVSS 4.0 base score of 9.3 reflects high confidentiality, integrity and availability impact, and no public exploit identified at time of analysis; the included gist and VulnCheck advisory serve as the primary public technical disclosures.
Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.6.3. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 60.2%.
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. This Cross-Site Request Forgery (CSRF) vulnerability could allow attackers to trick authenticated users into performing unintended actions.
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.