10Web Image Optimizer vulnerabilities

CVE-2023-2122 [MEDIUM] CWE-79 CVE-2023-2122: The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_ta The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitise and escape the iowd_tabs_active parameter before rendering it in the plugin admin panel, leading to a reflected Cross-Site Scripting vulnerability, allowing an attacker to trick a logged in admin to execute arbitrary javascript by clicking a link.

CVE-2023-2117 [LOW] CWE-22 CVE-2023-2117: The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when The Image Optimizer by 10web WordPress plugin before 1.0.27 does not sanitize the dir parameter when handling the get_subdirs ajax action, allowing a high privileged users such as admins to inspect names of files and directories outside of the sites root.