Threat Entry Updated 2024-11-21

CVE-2023-3352 - Smush Plugin

The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library.

PLUGIN Smush

CVE-2023-3352

MEDIUM CVSS 4.3 2024-06-21

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-11-21

CVE-2022-1009 - Smush Plugin

The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file

PLUGIN Smush

CVE-2022-1009

MEDIUM CVSS 6.1 2022-05-30

Risk Score

Open Full Technical Breakdown