Autoptimize (Autoptimize) - vulnerabilities (CVEs)

7 CVEs, 0 in the last 30 days, 84 known versions, newest CVE from 2023-05-30. Vendor: Autoptimize.

CVEs of Autoptimize

• CVE-2023-2113 - CVSS 4.8 (medium), 2023-05-30: The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such…
• CVE-2022-2635 - CVSS 4.8 (medium), 2022-09-16: The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to…
• CVE-2021-24378 - CVSS 4.8 (medium), 2021-06-21: The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a…
• CVE-2021-24377 - CVSS 8.1 (high), 2021-06-21: The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings'…
• CVE-2021-24376 - CVSS 9.8 (critical), 2021-06-21: The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature,…
• CVE-2021-24332 - CVSS 4.8 (medium), 2021-05-24: The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS…
• CVE-2020-24948 - CVSS 7.2 (high), 2020-09-03: The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege…