PT-2024-32603 · WordPress · Wp Compress – Image Optimizer [All-In-One]
Le Ngoc Anh
·
Published
2024-10-05
·
Updated
2024-10-09
·
CVE-2024-47384
CVSS v3.1
7.1
High
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
WP Compress – Image Optimizer [All-In-One] versions n/a through 6.20.13
Description
The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows Reflected XSS, which can be exploited by attackers. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited.
Recommendations
For WP Compress – Image Optimizer [All-In-One] versions n/a through 6.20.13, update to a version later than 6.20.13 to resolve the issue. As a temporary workaround, consider restricting access to the plugin until a patch is available. Avoid using the plugin for sensitive operations until the issue is resolved. At the moment, there is no other information about additional mitigation measures.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Wp Compress – Image Optimizer [All-In-One]