Skip to content
fr Sign in
Not rated

CVE-2021-24378 The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded…

Description

The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.

Affected products and versions

Product Affected versions Fixed in
Autoptimize 2.7 earliest → < 2.7.8 2.7.8

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Autoptimize

The 8 CVEs of Autoptimize →
CVE-2026-3220 The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress… 8.8 High CVE-2023-2113 The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export,… 4.8 Medium CVE-2022-4057 The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs 5.3 Medium CVE-2022-2635 The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow… Not rated
Track this CVE