WordPress CVEs

Description

Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php, which is not properly handled in a pngout error message.

Affected WordPress components

• EWWW Image Optimizer Plugin · ewww-image-optimizer
  Confirmed match Active
  Versions not specified
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• n/a n/a — Versions not specified
• ewww_image_optimizer_plugin_project ewww_image_optimizer_plugin — Up to and including 2.01
• ewww_image_optimizer_plugin_project ewww_image_optimizer_plugin — Version 2.0.0

References

• packetstormsecurity.com http://packetstormsecurity.com/files/128621/WordPress-EWWW-Image-Optimizer-2.0.1-Cross-Site-Scripting.html Exploit
• www.securityfocus.com http://www.securityfocus.com/archive/1/533641/100/0/threaded
• www.securityfocus.com http://www.securityfocus.com/bid/70190
• wordpress.org https://wordpress.org/plugins/ewww-image-optimizer/changelog Patch
• www.htbridge.com https://www.htbridge.com/advisory/HTB23234 Exploit
• nvd.nist.gov Official NVD record