CVE-2022-2449mediumCWE-352

CVE-2022-2449: medium-severity vulnerability in reSmush.it : the only free Image Optimizer &…

reSmush.it Image Optimizer < 0.4.7 - Multiple CSRF

Published · Updated

Follow this CVE+ Monitor reSmush.it : the only free Image Optimizer & compress plugin

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.4%
The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Affected products
Unknown · reSmush.it : the only free Image Optimizer & compress plugin
Related CVEs — reSmush.it : the only free Image Optimizer &…

In the same product, most dangerous first.

CVE-2022-2448—reSmush.it Image Optimizer < 0.4.6 - Admin+ Cross-Site ScriptingEPSS 0.6%CVE-2022-2450MEDIUMreSmush.it Image Optimizer < 0.4.4 - Subscriber+ AJAX CallsEPSS 0.6%