Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · jch-optimize
JCH Optimize
5 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 5, 2026JCH Optimize: Does not perform a capability check on one of its authenticated AJAX actions and lets the request chooseCVE-2026-84934 · fixed in 6.0.1 · reported by WPScanHigh 8
The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1 settings and store a script that executes in the browser of any visitor or administrator viewing the site.
Sep 5, 2026JCH Optimize: Does not properly restrict a directory path provided to one of its administrative image-browsing features to within the siteCVE-2025-15693 · fixed in 5.0.1 · reported by WPScanLow 2.7
The JCH Optimize WordPress plugin before 5.0.1 does not properly restrict a directory path provided to one of its administrative image-browsing features to within the site, allowing high-privilege users, administrators on single-site and sub-site administrators on multisite, to enumerate directories and file names outside the web root.
Jun 9, 2024JCH Optimize: Broken Access ControlCVE-2024-30481 · affects up to 4.0.0 · reported by PatchstackMedium 6.5
Broken Access Control vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.0.0.
May 16, 2024JCH Optimize: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-34808 · affects up to 4.2.0 · reported by PatchstackMedium 4.3
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Samuel Marshall JCH Optimize.This issue affects JCH Optimize: from n/a through 4.2.0.
May 6, 2023Auth.CVE-2023-25491 · fixed in 3.2.3 · reported by PatchstackMedium 5.9
Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Samuel Marshall JCH Optimize plugin <= 3.2.2 versions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.