CVE-2024-1047mediumCWE-862

CVE-2024-1047: falha de média gravidade em Optimole – Optimize Images in Real Time

ThemeIsle SDK <= Various Versions - Missing Authorization

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator+ Monitorar Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.6%
Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
optimole · Optimole – Optimize Images in Real Timeoptimole · Super Page Cachersocial · Revive Social – Social Media Auto Post and Scheduling Automation Pluginthemeisle · LightStart – Maintenance Mode, Coming Soon and Landing Page Builderthemeisle · Menu Icons by ThemeIslethemeisle · Multiple Page Generator Plugin – MPGthemeisle · Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & Morethemeisle · Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSEthemeisle · PPOM – Product Addons & Custom Fields for WooCommercethemeisle · RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregatorthemeisle · Starter Sites & Templates by Nevethemeisle · Visualizer: Tables and Charts Manager for WordPress
CVEs relacionadas — Optimole – Optimize Images in Real Time

No mesmo produto, das mais perigosas para as menos.

CVE-2026-5226MEDIUMOptimole <= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URLEPSS 0.5%CVE-2026-5217HIGHOptimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor ParameterEPSS 0.5%CVE-2024-4636MEDIUMImage Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.4%CVE-2025-11519MEDIUMImage optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media OffloadEPSS 0.3%CVE-2026-1843HIGHSuper Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity LogEPSS 0.2%