Unknown Squeeze vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Squeeze, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

5.4CVE-2026-110029unknownsqueeze
EPSS score
0.23%
The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing authenticated users with a role as low as Subscriber to revert any attachment to its backup copy and to permanently delete that backup and the plugin's generated WebP derivatives, regardless of ownership.8.8CVE-2026-16985unknownsqueeze+1
EPSS score
0.73%
The Squeeze WordPress plugin before 1.7.12 does not validate the file type or extension of the per-size image data written by one of its attachment-update actions, allowing users with the upload_files capability (Author and above) to write an executable PHP file into the uploads directory and achieve remote code execution.