CVE-2025-3951 — WP-Optimize < 4.2.0 - Admin+ SQLi
The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role …
Published: 2025-06-02 · CVSS: 4.1 · CVSS 3.1
The WP-Optimize WordPress plugin before 4.2.0 does not properly escape user input when checking image compression statuses, which could allow users with the administrator role to conduct SQL Injection attacks in the context of Multi-Site WordPress configurations.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7