Vendor
aresit
17 known vulnerabilities.
10 results · Clear filters · Feed
-
Medium 5.3
WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.22.01. This is due to the plugin not properly verifying that a user is authorized to perform an actio…
-
Medium 4.8
WP Compress <= 7.25.00 - Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), ho…
-
Medium 6.5
WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) fu…
-
Medium 5.3
WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability
Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress: from n/a through <= 6.60.28.
-
Medium 5.3
WordPress WP Compress Plugin <= 6.50.54 - Broken Access Control Vulnerability
Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Compress: from n/a through <= 6.50.54.
-
Medium 5.3
WordPress WP Compress plugin <= 6.30.30 - Broken Authentication Vulnerability
Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a through <= 6.30.30.
-
Medium 5.8
WP Compress <= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Function
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make we…
-
Medium 6.1
WP Compress – Instant Performance & Speed Optimization <= 6.30.03 - Reflected Cross-Site Scripting via custom_server Parameter
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output e…
-
Medium 6.5
WP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Missing Authorization
The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to, and including, 6.20.01. This makes it possible for authenticat…
-
Medium 4.3
WP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Open Redirect via css
The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to insufficient validation on the redirect url supplied via the 'css' parameter. This makes it possibl…