10web Image Optimizer vulnerabilities

2 CVEs affecting 10web Image Optimizer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-2122, published 2023-08-16.

More from 10web.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-2122, published 2023-08-16. Medium severity, CVSS 6.1. EPSS: 0.9% chance of exploitation in the next 30 days. The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected…
• CVE-2023-2117, published 2023-05-30. Low severity, CVSS 2.7. EPSS: 0.7% chance of exploitation in the next 30 days. The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect…