TinyPNG

Records2All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical0CVSS 9.0–10.0

CVSS high1CVSS 7.0–8.9

Exploited now

TinyPNG records in CISA KEV

No TinyPNG vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-06418 CVE-2026-7311 · GHSA-p2fp-6329-h7jp

Path traversal in TinyPNG – JPEG, PNG & WebP image compression

LOW 37

The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_converted_image_size function in all versions up to, a…

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.01035 Published 2026-07-02 No fix listed CWE-22

TI-2024-31914 CVE-2024-47635 · GHSA-3rpm-h4f9-j349

WordPress TinyPNG plugin <= 3.4.3 - Cross Site Request Forgery (CSRF) vulnerability

LOW 32

Cross-Site Request Forgery (CSRF) vulnerability in TinyPNG TinyPNG tiny-compress-images allows Cross Site Request Forgery.This issue affects TinyPNG: from n/a through <= 3.4.3.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.0018 Published 2024-10-05 No fix listed CWE-352

Open these records in search →

Critical	0
High	1
Medium	1
Low	0
No CVSS	0