CVE Database /
CVE-2022-1009
CVE · Medium
CVE-2022-1009 — Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.9.9
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2022-1009
|
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.9.9 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.1
|
< 3.9.9
|
3.9.9 |
2022-05-03 |
—
|
CVE-2022-1009
The Smush image optimization plugin for WordPress contains a reflected cross-site scripting vulnerability in versions up to 3.9.8 affecting the 'name' and 'description' parameters. The vulnerability stems from inadequate sanitization of inputs and escaping of outputs, allowing unauthenticated attackers to inject malicious scripts into pages that execute when viewed by a user. An attacker would need to deceive an administrator into uploading a specially crafted configuration file to successfully exploit this flaw.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings