Unknown Jch Optimize vulnerabilities

2 CVEs affecting Unknown Jch Optimize, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-84934, published 2026-09-05.

More from Unknown.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-84934, published 2026-09-05. High severity, CVSS 8.0. EPSS: 0.4% chance of exploitation in the next 30 days. The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any…
• CVE-2025-15693, published 2026-09-05. Low severity, CVSS 2.7. EPSS: 0.3% chance of exploitation in the next 30 days. The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege…