Resources /
WordPress Plugins /
Ewww Image Optimizer
PLUGIN SECURITY
Is Ewww Image Optimizer safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the Ewww Image Optimizer WordPress plugin — checked against WP Clinic's local security database.
What this plugin does
- Slug:
ewww-image-optimizer
Maintenance status
Known vulnerabilities
6 known CVEs on file for Ewww Image Optimizer.
Reported between 2014 and 2024.
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2024-31924
|
EWWW Image Optimizer [ewww-image-optimizer] < 7.3.0 |
Cross-Site Request Forgery (CSRF) |
Medium
4.3
|
< 7.3.0
|
7.3.0 |
2024-04-10 |
—
|
|
CVE-2023-40600
|
EWWW Image Optimizer [ewww-image-optimizer] < 7.2.1 |
Exposure of Sensitive Information to an Unauthorized Actor |
Medium
5.3
|
< 7.2.1
|
7.2.1 |
2023-11-14 |
—
|
|
—
|
EWWW Image Optimizer [ewww-image-optimizer] < 7.2.1 |
— |
Unknown
|
< 7.2.1
|
7.2.1 |
2023-09-08 |
—
|
|
CVE-2021-4342
|
EWWW Image Optimizer [ewww-image-optimizer] < 5.9 |
— |
Unknown
|
< 5.9
|
5.9 |
2023-06-07 |
—
|
|
—
|
EWWW Image Optimizer [ewww-image-optimizer] < 5.8.2 |
— |
Unknown
|
< 5.8.2
|
5.8.2 |
2020-09-16 |
—
|
|
CVE-2020-36750
|
EWWW Image Optimizer [ewww-image-optimizer] < 5.9 |
Cross-Site Request Forgery (CSRF) |
Medium
4.3
|
< 5.9
|
5.9 |
2020-09-06 |
—
|
|
—
|
EWWW Image Optimizer [ewww-image-optimizer] < 2.8.4 |
— |
Unknown
|
< 2.8.4
|
2.8.4 |
2016-06-09 |
—
|
|
CVE-2016-20010
|
EWWW Image Optimizer [ewww-image-optimizer] < 2.8.5 |
— |
Critical
10.0
|
< 2.8.5
|
2.8.5 |
2016-06-08 |
—
|
CVE-2024-31924
Update the WordPress EWWW Image Optimizer plugin to the latest available version (at least 7.3.0).
Dhabaleshwar Das discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress EWWW Image Optimizer Plugin. This could allow a malicious actor to force higher privileged users to execute unwanted actions under their current authentication. This vulnerability has been fixed in version 7.3.0.
This vulnerability was reported to and published by Patchstack. Our users receive alerts and protections up to 48 hours in advance.
Have additional information or questions about this entry? Get in touch.
Source:
Patchstack
CVE-2023-40600
The EWWW Image Optimizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.0 via the debug_log function. This makes it possible for unauthenticated attackers to extract sensitive debug data when debug logging is enabled.
Source:
Wordfence
EWWW Image Optimizer [ewww-image-optimizer] < 7.2.1
The EWWW Image Optimizer for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.2.0 due to the plugin saving debug logs in predictable locations. This can allow unauthenticated attackers to obtain information about installation paths, file permissions and various plugin settings.
Source:
Wordfence
CVE-2021-4342
CVE split into individual CVE IDs for each software record.
Source:
CVE.org
EWWW Image Optimizer [ewww-image-optimizer] < 5.8.2
Cross-Site Request Forgery (CSRF) vulnerability found by Jerome Bruandet (NinTechNet) in WordPress EWWW Image Optimizer plugin (versions <= 5.8.1).
Source:
Patchstack
CVE-2020-36750
The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or incorrect nonce validation on the ewww_ngg_bulk_init() function. This makes it possible for unauthenticated attackers to perform bulk image optimization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Source:
CVE.org
EWWW Image Optimizer [ewww-image-optimizer] < 2.8.4
Because of this vulnerability, attackers can create a backdoor or take a site down altogether.
Upgrade this plugin.
Source:
Patchstack
CVE-2016-20010
EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHP 5.5. Version 2.8.4 provides a partial fix.
Source:
Wordfence
+ 3 more known vulnerabilities
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2014-6243
|
EWWW Image Optimizer [ewww-image-optimizer] < 2.0.2 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Unknown
|
< 2.0.2
|
2.0.2 |
2014-09-04 |
—
|
|
—
|
EWWW Image Optimizer [ewww-image-optimizer] < 5.9 |
— |
Unknown
|
< 5.9
|
5.9 |
— |
—
|
|
—
|
EWWW Image Optimizer [ewww-image-optimizer] < 7.2.1 |
— |
Unknown
|
< 7.2.1
|
7.2.1 |
— |
—
|
CVE-2014-6243
Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php, which is not properly handled in a pngout error message.
Source:
CVE.org
EWWW Image Optimizer [ewww-image-optimizer] < 5.9
Source: https://www.wordfence.com/threat-intel/vulnerabilities/detail/various-affected-software-various-versions-cross-site-request-forgery-bypass
EWWW Image Optimizer [ewww-image-optimizer] < 7.2.1
The EWWW Image Optimizer for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.2.0 due to the plugin saving debug logs in predictable locations. This can allow unauthenticated attackers to obtain information about installation paths, file permissions and various plugin settings.
Source:
WPScan
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.