Wpmudev Smush Image Compression And Optimization vulnerabilities

2 CVEs affecting Wpmudev Smush Image Compression And Optimization, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-1009, published 2022-05-30.

More from Wpmudev.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-15079, published 2017-10-06. High severity, CVSS 7.5. EPSS: 2.5% chance of exploitation in the next 30 days. The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.
• CVE-2022-1009, published 2022-05-30. Medium severity, CVSS 6.1. EPSS: 0.8% chance of exploitation in the next 30 days. The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a…