Vulnerabilities

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Stored XSS.This issue affects ShortPixel Image…

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00156 Published 2026-10-08 No fix listed CWE-79

TI-2026-63987 CVE-2026-97246 · GHSA-x62g-qgmr-chj3

WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability

LOW 22

Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5.

CVSS 3.1MEDIUM 4.9 Network Low privileges No interaction EPSS 0.00208 Published 2026-09-30 No fix listed CWE-502

TI-2026-14215 CVE-2026-17086 · GHSA-mqfm-qx5g-96vc

ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content

MEDIUM 43

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input .

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01327 Published 2026-09-18 No fix listed CWE-502

TI-2026-12915 CVE-2026-15345 · GHSA-6c4v-hv9q-25jc

Missing authorization in ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization

LOW 20

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.11.5.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00428 Published 2026-08-16 No fix listed CWE-862

TI-2026-41279 CVE-2026-57342 · GHSA-h7qc-4h62-77r8

WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability

LOW 28

Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00224 Published 2026-07-02 No fix listed CWE-79

TI-2026-41546 CVE-2026-57722 · GHSA-c8m2-cj6f-v5p6

WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace allows Stored XSS.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.0024 Published 2026-07-01 No fix listed CWE-79

TI-2026-40458 CVE-2026-56066 · GHSA-v6hj-467c-2chv

WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerability

LOW 32

Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00466 Published 2026-06-26 No fix listed CWE-22

TI-2026-28445 CVE-2026-39471 · GHSA-8wj8-vcgv-j3hf

WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability

LOW 34

Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00446 Published 2026-06-15 No fix listed CWE-502

TI-2026-05012 CVE-2026-5714 · GHSA-p8qg-vv8c-8jmw

Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter

LOW 28

The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘location_dir’ parameter in all versions up to, and including, 4.1.8 due to insufficient input sanitization and output es…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00257 Published 2026-06-09 No fix listed CWE-79

TI-2026-03774 CVE-2026-4335 · GHSA-g8cg-xh22-8v5v

ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title

LOW 24

The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attachment post_title in all versions up to, and including, 6.4.3.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00179 Published 2026-03-26 No fix listed CWE-79

TI-2026-02338 CVE-2026-2732 · GHSA-jw7h-j47j-qm3h

Missing authorization in ShortPixel Enable Media Replace

LOW 24

The Enable Media Replace plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'RemoveBackGroundViewController::load' function in all versions up to, and inclu…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00254 Published 2026-03-04 No fix listed CWE-862

TI-2026-00965 CVE-2026-1246 · GHSA-m3h6-h8v2-vr8w

ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter

LOW 23

The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in all versions up to, and including, 6.4.2 due to insufficient path validation and…

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.0058 Published 2026-02-05 No fix listed CWE-22

TI-2025-10425 CVE-2025-11378 · GHSA-44j2-7x4f-pq34

ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export

LOW 24

The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'shortpixel_ajaxRequest' AJAX action…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00319 Published 2025-10-18 No fix listed CWE-862

TI-2025-08702 CVE-2025-9496 · GHSA-48rp-r93x-fvf8

Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode

LOW 28

The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and including, 4.1.6 due to insufficient input sanitization and o…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00244 Published 2025-10-11 No fix listed CWE-79

TI-2025-06018 CVE-2025-6626 · GHSA-v6g9-v26j-6w22

Cross-site scripting in ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization

LOW 20

The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including, 3.10.3 due to insuffici…

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00284 Published 2025-08-02 No fix listed CWE-79

TI-2025-22351 CVE-2025-31081 · GHSA-hjj5-539p-596j

WordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 32

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace enable-media-replace allows Reflected XSS.This issue affects Enable Media Replace: fro…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00422 Published 2025-04-01 No fix listed CWE-79

TI-2025-22123 CVE-2025-30853 · GHSA-fxj6-7gh4-px89

WordPress ShortPixel Adaptive Images plugin <= 3.10.0 - Broken Authentication vulnerability

LOW 25

Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Adaptive Image…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00455 Published 2025-04-01 No fix listed CWE-862

TI-2024-32246 CVE-2024-48044 · GHSA-p4pg-h39v-m85q

WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - Broken Access Control vulnerability

LOW 38

Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimize…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00391 Published 2024-11-01 No fix listed CWE-862

TI-2024-32245 CVE-2024-48043 · GHSA-g487-gqfx-jgg8

WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - SQL Injection vulnerability

LOW 36

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Blind SQL Injection.This issue affects ShortPi…

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.00447 Published 2024-10-17 No fix listed CWE-89

TI-2024-05509 CVE-2024-5945 · GHSA-jm7q-rxr5-2rpf

WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG

LOW 28

The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to insufficient input sanitization.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00328 Published 2024-06-21 No fix listed CWE-79

TI-2024-23247 CVE-2024-35172 · GHSA-8q3w-rh8p-p597

WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability

LOW 20

Server-Side Request Forgery (SSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.3.

CVSS 3.1MEDIUM 4.4 Network High privileges No interaction EPSS 0.00363 Published 2024-05-13 No fix listed CWE-918

TI-2024-04364 CVE-2024-4689 · GHSA-v484-r27j-mv8x

WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Cross Site Request Forgery (CSRF) vulnerability

LOW 20

Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a through <= 3.8.3.

CVSS 3.1MEDIUM 4.3 Network No auth User interaction EPSS 0.0025 Published 2024-05-10 No fix listed CWE-352

TI-2024-21684 CVE-2024-32810 · GHSA-584j-c6jj-2crq

WordPress ShortPixel Critical CSS plugin <= 1.0.2 - Broken Access Control vulnerability

LOW 36

Missing Authorization vulnerability in ShortPixel ShortPixel Critical CSS.This issue affects ShortPixel Critical CSS: from n/a through 1.0.2.

CVSS 3.1HIGH 7.6 Network Low privileges No interaction EPSS 0.00431 Published 2024-05-03 No fix listed CWE-862