CVE-2022-2449

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 does not perform CSRF checks for any of its AJAX actions, allowing an attackers to trick logged in users to perform various actions on their behalf on the site.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

No affected versions have been published.

Timeline

Published
Nov 14, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-244908.1Windows Hyper-V Shared Virtual Hard Disks Information Disclosure VulnerabilityCVE-2022-244919.8Windows Network File System Remote Code Execution VulnerabilityCVE-2022-244928.8Remote Procedure Call Runtime Remote Code Execution VulnerabilityCVE-2022-244935.5Microsoft Local Security Authority (LSA) Server Information Disclosure VulnerabilityCVE-2022-244947.8Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityCVE-2022-244957.0Windows Direct Show Remote Code Execution VulnerabilityCVE-2022-244967.8Windows Local Security Authority (LSA) Elevation of Privilege VulnerabilityCVE-2022-244979.8Windows Network File System Remote Code Execution VulnerabilityCVE-2022-244986.5Windows iSCSI Target Service Information Disclosure VulnerabilityCVE-2022-244997.8Windows Installer Elevation of Privilege VulnerabilityCVE-2022-24504.3The reSmush.it : the only free Image Optimizer & compress plugin WordPress plugin before 0.4.4 lacks authorization in various AJAX actions, CVE-2022-245008.8Windows SMB Remote Code Execution Vulnerability
CVE-2022-2449: Medium severity, CVSS 6.5 | Vulnix