CVE-2024-1047mediumCWE-862

CVE-2024-1047: fallo de gravedad media en Optimole – Optimize Images in Real Time

ThemeIsle SDK <= Various Versions - Missing Authorization

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator+ Monitorear Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.3epss 0.6%
Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Productos afectados
optimole · Optimole – Optimize Images in Real Timeoptimole · Super Page Cachersocial · Revive Social – Social Media Auto Post and Scheduling Automation Pluginthemeisle · LightStart – Maintenance Mode, Coming Soon and Landing Page Builderthemeisle · Menu Icons by ThemeIslethemeisle · Multiple Page Generator Plugin – MPGthemeisle · Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & Morethemeisle · Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSEthemeisle · PPOM – Product Addons & Custom Fields for WooCommercethemeisle · RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregatorthemeisle · Starter Sites & Templates by Nevethemeisle · Visualizer: Tables and Charts Manager for WordPress
CVEs relacionadas — Optimole – Optimize Images in Real Time

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-5226MEDIUMOptimole <= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URLEPSS 0.5%CVE-2026-5217HIGHOptimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor ParameterEPSS 0.5%CVE-2024-4636MEDIUMImage Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.4%CVE-2025-11519MEDIUMImage optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media OffloadEPSS 0.3%CVE-2026-1843HIGHSuper Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity LogEPSS 0.2%