https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-47546.htmlhttps://patchthecve.com/cve/CVE-2025-47546.htmlWed, 17 Jun 2026 09:28:17 +0000HIGH 7.1: Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Cross Site Request Forgery.This issue affects WP Compress: from n/a through <= 6.30.30.https://patchthecve.com/cve/CVE-2025-2110.htmlhttps://patchthecve.com/cve/CVE-2025-2110.htmlWed, 17 Jun 2026 09:06:20 +0000HIGH 8.8: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated ahttps://patchthecve.com/cve/CVE-2025-2109.htmlhttps://patchthecve.com/cve/CVE-2025-2109.htmlWed, 17 Jun 2026 09:06:20 +0000MEDIUM 5.8: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originahttps://patchthecve.com/cve/CVE-2024-12047.htmlhttps://patchthecve.com/cve/CVE-2024-12047.htmlWed, 17 Jun 2026 06:58:57 +0000MEDIUM 6.1: The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthttps://patchthecve.com/cve/CVE-2024-47384.htmlhttps://patchthecve.com/cve/CVE-2024-47384.htmlWed, 17 Jun 2026 07:57:00 +0000HIGH 7.1: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Reflected XSS.This issue affects WP Compress: from n/a through <= 6.20.13.https://patchthecve.com/cve/CVE-2024-4445.htmlhttps://patchthecve.com/cve/CVE-2024-4445.htmlWed, 17 Jun 2026 08:01:53 +0000MEDIUM 6.5: The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to, and including, 6.20.01. This makes it possible for authenticated attackers, with subscriber-level permihttps://patchthecve.com/cve/CVE-2023-6812.htmlhttps://patchthecve.com/cve/CVE-2023-6812.htmlWed, 17 Jun 2026 06:51:28 +0000MEDIUM 4.3: The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to insufficient validation on the redirect url supplied via the 'css' parameter. This makes it possible for unauthenticated attackers to redirehttps://patchthecve.com/cve/CVE-2024-32106.htmlhttps://patchthecve.com/cve/CVE-2024-32106.htmlWed, 17 Jun 2026 07:29:17 +0000MEDIUM 4.3: Cross-Site Request Forgery (CSRF) vulnerability in WP Compress WP Compress – Image Optimizer [All-In-One].This issue affects WP Compress – Image Optimizer [All-In-One]: from n/a through 6.10.35.https://patchthecve.com/cve/CVE-2024-1934.htmlhttps://patchthecve.com/cve/CVE-2024-1934.htmlWed, 17 Jun 2026 07:05:26 +0000HIGH 7.5: The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wps_local_compress::__construct' function in all versions up to, and including, 6.11.10. This makes it possible for unauthenticated attackers to reset thttps://patchthecve.com/cve/CVE-2023-6699.htmlhttps://patchthecve.com/cve/CVE-2023-6699.htmlWed, 17 Jun 2026 06:51:15 +0000CRITICAL 9.1: The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain