CVE-2025-3951

4.1 mediumEPSS 0.3%

Medium (4.1) in updraftplus wp-optimize. EPSS 0.3% chance of exploitation in the next 30 days.

The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the context of Multi-Site WordPress configurations.

Severity

CVSS 3.1

4.1 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 26% of CVEs (scores of 2026-10-31)
CWE: CWE-89
Published: 2025-06-02
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

updraftplus:wp-optimize

References

https://wpscan.com/vulnerability/220c195f-3df3-4883-8e0b-a0cf019e6323/
https://wpscan.com/vulnerability/220c195f-3df3-4883-8e0b-a0cf019e6323/

Check your stack JSON