unknown smush vulnerabilities, newest first
Filter
By year: all 2026 2025 2024 2023 2022 2021
- 2.7CVE-2026-118241EPSS 0.3%
The Smush WordPress plugin before 4.3.6 does not verify that a user is authorised to act on the targeted media attachment, only checking a broad upload-files capability, which allows users with the Author role and above to optimise and re…