Skip to content

Product

10web image optimizer vulnerabilities

2 published CVES affecting 10web image optimizer, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
0
Medium
1
Low
1
Unscored
0
CISA KEV
0

Latest 10web image optimizer CVEs

Newest publication first

  1. CVE-2023-2122 Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site Scripting

    Published
    MediumCVSS 6.1 EPSS 0.85%

    The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to exe...

  2. CVE-2023-2117 Image Optimizer by 10web < 1.0.27 - Admin+ Path Traversal

    Published
    LowCVSS 2.7 EPSS 0.66%

    The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.