ImageInject

ImageInject has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2018 and 2022; 2 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2018 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (67%). Other recurring categories include Cross-Site Request Forgery (CSRF).

2 of the records (67%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2022.

2 independent researchers contributed these findings, most of them (2) reported by d4wner.

Strategic Overview

Avg CVSSMedium

6.8/ 10

Patch Coverage67%

Open

Fixed

Get automatic notifications for all ImageInject vulnerabilities before they are exploited.

Most severe open issueCVSS 5.5CVE-2022-4243

ImageInject <= 1.18 - Authenticated (Admin+) Stored XSS

Read the full analysis

Vulnerability Records

3 records


2022-12-02 00:00	ImageInject <= 1.18 - Authenticated (Admin+) Stored XSS ImageInject <= 1.18	`CVE-2022-4243`	5.5 Medium	iohex	No
2018-01-04 00:00	ImageInject <= 1.15 - Cross-Site Request Forgery ImageInject <= 1.15	`CVE-2018-5285`	8.8 High	d4wner	Yes
2018-01-04 00:00	ImageInject <= 1.15 - Cross-Site Scripting ImageInject <= 1.15	`CVE-2018-5284`	6.1 Medium	d4wner	Yes

Showing 1–3 of 3 reports