Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: EWWW Image Optimizer 8.8.0 Clear all filters
TI-2026-61865 CVE-2026-91072 · GHSA-6w6r-chf5-m436

EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler

Priority LOW 20

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or…

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00168 Published 2026-09-30 Fixed in 8.8.0 CWE-73
TI-2026-61864 CVE-2026-91051 · GHSA-rhvr-pxgv-9rpq

EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta

Priority LOW 31

The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendere…

CVSS 3.1MEDIUM 6.6 Network High privileges No interaction EPSS 0.0034 Published 2026-09-30 Fixed in 8.8.0 CWE-502