Description

WordPress Plugin Seo Optimized Images contains malicous code. Exploiting this issue may allow an attacker to create a new administrative user account, thus compromising the affected application, and possibly the webserver or computer. WordPress Plugin Seo Optimized Images version 2.1.2 is affected.

Remediation

Update to plugin version 2.1.4 or latest

References

https://www.wordfence.com/blog/2024/06/3-more-plugins-infected-in-wordpress-org-supply-chain-attack-due-to-compromised-developer-passwords/

https://plugins.trac.wordpress.org/changeset/3109373

Related Vulnerabilities

Oracle Application Server Resource Management Errors Vulnerability (CVE-2007-2120)

Liferay Portal URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2023-35029)

Ampache Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2024-51490)

WordPress Plugin Google +1 by BestWebSoft Cross-Site Scripting (1.3.3)

WordPress Plugin HTML5 Video Player-Best WordPress Video Player and Block SQL Injection (2.5.26)

Severity

High

Classification

CVE-2024-6297 CWE-506 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Tags

Missing Update