CVE-2014-6243
Published
CVSS v3
N/A
CVSS v2
4.3
MEDIUM
Affected
1
PROJECT
Description
Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php, which is not properly handled in a pngout error message.
<p>Are you frustrated by a slow website? Do over-sized images make you say “ewww”… Image optimization with EWWW Image Optimizer helps you make your site faster, improve your bounce rate, and boost your SEO. But most importantly, make your visitors happier so they keep coming back for more.</p>
<h4>Why use EWWW Image Optimizer?</h4>
<p><strong>Get all this for free:</strong></p>
<ul>
<li>Unlimited image optimization to compress images of any size</li>
<li>Local image optimization mode compatible with <a href="https://docs.ewww.io/article/43-supported-web-hosts" rel="nofollow ugc">most web hosts</a></li>
<li>Lossless JPG, PNG, GIF, and SVG image optimization (8% average savings)</li>
<li>WebP conversion compatible with all web hosts (60% average savings)</li>
<li>Optimize images from <a href="https://docs.ewww.io/article/84-plugin-compatibility" rel="nofollow ugc">any plugin</a></li>
<li>Image Detective to help you identify improperly scaled images and better optimize LCP images</li>
<li>Resize images at upload or in bulk</li>
<li>Lazy Load with auto-scaling for responsive images–uses properly-sized placeholders to prevent layout shift (CLS)</li>
<li>Sharpen thumbnail images for better quality</li>
<li>Adjust JPG and WebP quality (AVIF quality configurable in premium)</li>
<li>Control creation and optimization of individual WordPress thumbnails</li>
<li>Convert images to the best format (GIF to PNG, PNG to JPG or vice versa)</li>
<li>Local image backups</li>
<li>Preserve GIF animations in thumbnails</li>
<li><a href="https://ewww.io/contact-us/" rel="nofollow ugc">Free email support</a></li>
</ul>
<p>EWWW Image Optimizer is the only plugin that lets you optimize images using tools on your own web server (jpegtran, optipng, pngout, pngquant, gifsicle, cwebp). This requires the PHP exec() function and a <a href="https://docs.ewww.io/article/43-supported-web-hosts" rel="nofollow ugc">compatible</a> Linux, Windows, MacOS, or FreeBSD web server. <a href="https://docs.ewww.io/article/29-what-is-exec-and-why-do-i-need-it" rel="nofollow ugc">If your web server is not compatible, we offer unlimited lossless JPG image optimization and WebP conversion via our Compress API **for free*</a>.</p>
<p><strong>Upgrade to <a href="https://ewww.io/plans/" rel="nofollow ugc">Premium</a> for:</strong></p>
<ul>
<li>5x premium image optimization</li>
<li>PDF optimization</li>
<li>Automatic scaling for all images, even those in external CSS</li>
<li>One-click WebP & AVIF conversion and delivery</li>
<li>Enhanced responsive images that use correct dimensions for all devices</li>
<li>WebP image optimization</li>
<li>Deliver High-DPI images to devices with 2x and 3x screens (retina)</li>
<li>Watermark images</li>
<li>CDN delivery for images, CSS, JS, and fonts with custom domain name option</li>
<li>30-day cloud-based backups</li>
<li><a href="https://ewww.io/about/" rel="nofollow ugc">Premium support</a></li>
</ul>
<p><a href="https://ewww.io/plans/" rel="nofollow ugc">Premium plans</a> include SWIS Performance plugin with:</p>
<ul>
<li>Page caching</li>
<li>Enable browser caching with long cache lifetimes</li>
<li>Defer JS/CSS to eliminate render blocking requests</li>
<li>Minify JS/CSS</li>
<li>Critical CSS generation to prevent layout shifting (CLS)</li>
<li>Optimize font display/self-host Google fonts</li>
<li>Preload assets like fonts and LCP images</li>
<li>Reduce unused JS/CSS</li>
<li>Manage speculative loading</li>
</ul>
<h4>Automatic Everything</h4>
<p>Optimize images on your entire site with a single click. With <a href="https://ewww.io/plans/" rel="nofollow ugc">Easy IO CDN</a>, images are automatically compressed, scaled to fit the page and device size, lazy loaded, and converted to next-gen WebP and AVIF formats.</p>
<h4>Support</h4>
<p><a href="https://ewww.io/contact-us/" rel="nofollow ugc">We provide free one-on-one email support to everyone</a>.<br />
Do you have an idea to make EWWW Image Optimizer even better? <a href="https://feedback.ewww.io/b/features" rel="nofollow ugc">Share it and vote on future features</a>!</p>
<p>Found a bug? Report the issue on <a href="https://github.com/nosilver4u/ewww-image-optimizer" rel="nofollow ugc">GitHub</a>, and we’ll get it fixed!</p>
<p>You may report security issues through our Patchstack Vulnerability Disclosure Program. The Patchstack team helps validate, triage and handle any security vulnerabilities. <a href="https://patchstack.com/database/vdp/ewww-image-optimizer" rel="nofollow ugc">Report a security vulnerability.</a></p>
<h4>Bulk Optimize</h4>
<p>Optimize images, all from a single page. This includes the Media Library, your theme, and a handful of pre-configured folders (see Optimize Everything Else below). GRAND FlaGallery, NextCellent and NextGEN have their own Bulk Optimize pages.</p>
<h4>Optimize Everything Else</h4>
<p>Configure any folder within your WordPress install to optimize images. The Bulk Optimizer will compress theme images, BuddyPress avatars, BuddyPress Activity Plus images, Meta Slider slides, WP Symposium Pro avatars, GD bbPress attachments, Grand Media Galleries, and any user-specified folders. You can also use Scheduled optimization or run the optimizer from WP-CLI if that’s more your thing.</p>
<h4>Plugin Compatibility</h4>
<p>EWWW Image Optimizer has been tested with thousands of <a href="https://docs.ewww.io/article/84-plugin-compatibility" rel="nofollow ugc">plugins and themes</a>, here are just a few of the most common ones: BuddyPress (Activity Plus add-on too), Cloudinary, Easy Watermark, FileBird, FooGallery, GD bbPress Attachments, GRAND FlAGallery, Gmedia Photo Gallery, MediaPress, Meta Slider, Microsoft Azure Storage, MyArcadePlugin, NextGEN Gallery, Regenerate Thumbnails, <a href="https://weglot.com/integrations/wordpress-translation-plugin/demo/" rel="nofollow ugc">Weglot</a>, WP Offload Media, <a href="https://wpml.org/plugin/ewww-image-optimizer/" rel="nofollow ugc">WPML</a>, WP Retina 2x, WP RSS Aggregator, WP Symposium, <a href="https://docs.ewww.io/article/84-plugin-compatibility" rel="nofollow ugc">and more…</a></p>
<h4>WebP Images</h4>
<p>If you want simple, get automatic WebP conversion with Easy IO, and be done with it! Otherwise, you can generate WebP versions of unlimited images with the Bulk Optimizer. Deliver them to supported browsers with Apache-style rewrite rules, JS WebP Rewriting, or Picture WebP Rewriting. EWWW Image Optimizer even works with the WebP option in the Cache Enabler plugin from KeyCDN.</p>
<h4>AVIF Images</h4>
<p>AVIF conversion is built into the Easy IO CDN. Once your site is setup with Easy IO, edit the site settings to enable AVIF, and you’re done!</p>
<h4>WP-CLI</h4>
<p>Allows you to run all batch image processes from the command line, instead of the web interface. Optimize images even faster, run it in ‘screen’ or via regular cron (instead of wp-cron, which can be unpredictable on low-traffic sites). Install WP-CLI from wp-cli.org, and run ‘wp-cli.phar help ewwwio optimize’ for more information or see the <a href="https://docs.ewww.io/article/25-optimizing-with-wp-cli" rel="nofollow ugc">Docs</a>.</p>
<h4>CDN Support</h4>
<p><a href="https://wordpress.org/plugins/amazon-s3-and-cloudfront/" rel="ugc">WP Offload Media</a> is the officially supported (and recommended) plugin for uploads to Amazon S3, Digital Ocean Spaces, and Google Cloud Storage. <a href="https://docs.ewww.io/article/84-plugin-compatibility" rel="nofollow ugc">Check our compatibility list for details on other plugins</a>. All pull mode CDNs like Cloudflare, KeyCDN, Bunny CDN and Sucuri work automatically, but you will need to purge the CDN cache after you optimize images with bulk optimization.</p>
<h4>Translations</h4>
<p>Huge thanks to all our translators, <a href="https://translate.wordpress.org/projects/wp-plugins/ewww-image-optimizer/contributors" rel="nofollow ugc">see the full list</a>!</p>
<p>If you would like to help translate this plugin, <a href="https://translate.wordpress.org/projects/wp-plugins/ewww-image-optimizer" rel="nofollow ugc">join the team</a>.<br />
<a href="https://ewww.io/register/" rel="nofollow ugc">Signup to receive updates when new strings are available for translation</a>.</p>
<h3>Credits</h3>
<p>Written by <a href="https://ewww.io" rel="nofollow ugc">Shane Bishop</a> with special thanks to my <a href="https://www.iamsecond.com/" rel="nofollow ugc">Lord and Savior</a>. Based upon CW Image Optimizer, which was written by <a href="http://www.jacoballred.com/" rel="nofollow ugc">Jacob Allred</a> at <a href="http://www.corbanworks.com/" rel="nofollow ugc">Corban Works, LLC</a>. CW Image Optimizer was based on WP Smush.it. Jpegtran is the work of the Independent JPEG Group. PEL is the work of Martin Geisler, Lars Olesen, and Erik Oskam. Easy IO and HTML parsing classes based upon the Photon module from Jetpack.</p>