WordPress security by component
Image Optimizer by 10web
Plugin description
Image Optimizer by 10web compresses and optimizes WordPress images for website delivery.
Image Optimizer by 10web (image-optimizer) is a WordPress plugin with 5 published CVE records in this archive. The latest tracked vulnerability was published Sep 30, 2026; the highest published CVSS base score is 6.1.
Plugin slug:
image-optimizerLatest vulnerability
CVE-2026-90953: Image Optimizer: REST read routes expose restricted attachment metadata and statistics
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators. The authoritative export does not name the request parameter or handler beyond the affected feature described above. The authoritative export identifies the fixed release as 1.7.7.
| Safe version |
|
||
|---|---|---|---|
| Sep 30, 2026 |
CVE-2026-90953
Image Optimizer: REST read routes expose restricted attachment metadata and statistics
The Image Optimizer WordPress plugin before 1.7.7 does not enforce its intended capability check on several of its read REST routes, allowing any authenticated user to read attachment metadata and site-wide statistics that should be restricted to administrators. The authoritative export does not name the request parameter or handler beyond the affected feature described above. The authoritative export identifies the fixed release as 1.7.7.
|
1.7.7 |
CVE4.3
NVDPending
|
| Nov 01, 2024 |
CVE-2024-48044
ShortPixel Image Optimizer: A security weakness
ShortPixel Image Optimizer is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.4
NVD8.8
|
| Aug 16, 2023 |
CVE-2023-2122
Image Optimizer by 10web: Cross-site scripting
Image Optimizer by 10web is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVEPending
NVD6.1
|
| Jul 12, 2023 |
CVE-2020-36750
EWWW Image Optimizer: Cross-site request forgery
EWWW Image Optimizer is affected by cross-site request forgery. The vulnerable path is reachable without authentication. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE4.3
NVDPending
|
| May 30, 2023 |
CVE-2023-2117
Image Optimizer by 10web: A security weakness
Image Optimizer by 10web is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE2.7
NVD2.7
|