Read the docs

ShortPixel

Records33All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9

Exploited now

ShortPixel records in CISA KEV

No ShortPixel vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Enable Media Replace 4 records HIGH Shortpixel Adaptive Images 3 records MEDIUM Image Optimizer 1 record LOW

Records

4 records in Enable Media Replace · all components

TI-2023-04280 CVE-2023-4643 · GHSA-h9gw-q7wq-vrfv

Enable Media Replace < 4.1.3 - Author+ PHP Object Injection

Priority HIGH 73

The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the b…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01052 Published 2023-10-16 Fixed in 4.1.3
TI-2023-00241 CVE-2023-0255 · GHSA-j47r-gcvh-59g7

Enable Media Replace < 4.0.2 - Author+ Arbitrary File Upload

Priority HIGH 73

The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01096 Published 2023-02-13 Fixed in 4.0.2 CWE-434
TI-2023-06157 CVE-2023-6737 · GHSA-fh2m-jg7j-ghwg

Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting

Priority LOW 28

The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and outp…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00493 Published 2024-01-11 No fix listed CWE-79
TI-2022-02359 CVE-2022-2554 · GHSA-pr9x-p233-rm4x

Enable Media Replace < 4.0.0 - Admin+ Path Traversal

Priority LOW 24

The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root director…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00972 Published 2022-10-10 Fixed in 4.0.0 CWE-22
Open these records in search →