WordPress Smush Image Compression and Optimization plugin <= 4.3.5 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Smush Image Compression and Optimization wp-smushit allows Stored XSS.This issue affects Smush Image Compression and Optimization: from n/a through 4.3.5.

WordPress Smush Image Compression and Optimization plugin <= 4.2.0 - Denial of Service Attack vulnerability

Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.

WordPress Smush Image Compression and Optimization plugin <= 3.17.0 - Directory Traversal vulnerability

Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a through <= 3.17.0.

The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.

Smush < 3.9.9 - Admin+ Reflected Cross-Site Scripting

The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file