Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-30
Image Optimizer - Security Vulnerability (CVE-2026-90953)
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators.
PLUGIN
Image Optimizer
CVE-2026-90953
Risk Score
Threat Entry
Updated 2026-07-02
Image Optimizer - Denial of Service (CVE-2026-5821)
The Image Optimizer plugin for WordPress is vulnerable to arbitrary file deletion in versions up to and including 1.7.4. This is due to insufficient path validation in the Image_Backup::remove() function where backup file paths stored in post meta are used directly in file deletion operations without verifying they are within the uploads directory. The plugin stores backup file paths in the image_optimizer_metadata post meta field and trusts these paths completely when deleting backups on the delete_attachment hook. An authenticated attacker with Author-level access can edit the image_optimizer_metadata post meta on…
PLUGIN
Image Optimizer
CVE-2026-5821
Risk Score
Threat Entry
Updated 2026-06-17
Image Optimizer - Broken Access Control (CVE-2024-48044)
Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimizer: from n/a through
PLUGIN
Image Optimizer
CVE-2024-48044
Risk Score
Threat Entry
Updated 2026-06-17
Image Optimizer - Information Disclosure (CVE-2023-40600)
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log is turned on.This issue affects EWWW Image Optimizer: from n/a through 7.2.0.
PLUGIN
Image Optimizer
CVE-2023-40600
Risk Score
Threat Entry
Updated 2026-06-17
Image Optimizer - Cross-Site Scripting (XSS) (CVE-2023-2122)
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.
PLUGIN
Image Optimizer
CVE-2023-2122
Risk Score
Threat Entry
Updated 2026-06-17
Image Optimizer - Cross-Site Request Forgery (CSRF) (CVE-2020-36750)
The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or incorrect nonce validation on the ewww_ngg_bulk_init() function. This makes it possible for unauthenticated attackers to perform bulk image optimization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
Image Optimizer
CVE-2020-36750
Risk Score
Threat Entry
Updated 2026-06-17
Image Optimizer - Cross-Site Scripting (XSS) (CVE-2023-2117)
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.
PLUGIN
Image Optimizer
CVE-2023-2117
Risk Score
Threat Entry
Updated 2026-06-17
Image Optimizer - Security Vulnerability (CVE-2016-20010)
EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHP 5.5.
PLUGIN
Image Optimizer
CVE-2016-20010
Risk Score