Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: Autoptimize 2.7.8 Clear all filters
TI-2021-06670 CVE-2021-24378 · GHSA-27r4-rp49-685c

Autoptimize < 2.7.8 - Authenticated Stored XSS via File Upload

Priority LOW 23

The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00617 Published 2021-06-21 Fixed in 2.7.8 CWE-79
TI-2021-06669 CVE-2021-24377 · GHSA-4639-xx39-q537

Autoptimize < 2.7.8 - Race Condition leading to RCE

Priority LOW 38

The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a…

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.01183 Published 2021-06-21 Fixed in 2.7.8 CWE-362
TI-2021-06668 CVE-2021-24376 · GHSA-8637-ph22-g43w

Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"

Priority MEDIUM 48

The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03727 Published 2021-06-21 Fixed in 2.7.8 CWE-434