Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-12
Smush - Security Vulnerability (CVE-2026-118241)
The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and restore attachments owned by other users, altering their files on disk and consuming the stored backup.
PLUGIN
Smush
CVE-2026-118241
Risk Score
Threat Entry
Updated 2026-08-28
Smush - Security Vulnerability (CVE-2026-19223)
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
PLUGIN
Smush
CVE-2026-19223
Risk Score
Threat Entry
Updated 2026-06-17
Smush - Broken Access Control (CVE-2023-3352)
The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library.
PLUGIN
Smush
CVE-2023-3352
Risk Score
Threat Entry
Updated 2026-06-17
Smush - Cross-Site Scripting (XSS) (CVE-2022-1009)
The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file
PLUGIN
Smush
CVE-2022-1009
Risk Score