10Web Image Optimizer vulnerabilities

2 vulnerabilities

Known vulnerabilities in 10Web Image Optimizer, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

2.7CVE-2023-211710webimage_optimizer+2
EPSS score
0.66%
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.6.1CVE-2023-212210webimage_optimizer+2
EPSS score
0.85%
The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.