Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

ShortPixel — Vulnerabilities & Security Advisories 27

Browse all 27 CVE security advisories affecting ShortPixel. AI-powered Chinese analysis, POCs, and references for each vulnerability.

ShortPixel is an image optimization service that compresses and delivers web images to improve website performance. Historically, the platform has been vulnerable to multiple security issues including remote code execution (RCE), cross-site scripting (XSS), and privilege escalation vulnerabilities. These flaws have allowed attackers to execute arbitrary code, manipulate web content, or gain unauthorized access to systems. The service has accumulated 18 CVEs, indicating a pattern of security concerns that have required patches and updates. While no major public security incidents have been widely reported, the consistent discovery of vulnerabilities suggests ongoing challenges in maintaining secure image processing and delivery infrastructure.

CVE ID Title CVSS Severity Published
CVE-2026-103070 WordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (XSS) vulnerability — ShortPixel Image Optimizer CWE-79 6.5 Medium 2026-10-08
CVE-2026-97246 WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability — ShortPixel Image Optimizer CWE-502 4.9 Medium 2026-09-30
CVE-2026-17086 ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content — ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF CWE-502 8.8 High 2026-09-18
CVE-2026-15345 ShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter — ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization CWE-862 4.3 Medium 2026-08-16
CVE-2026-57342 WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability — ShortPixel Adaptive Images CWE-79 6.5 Medium 2026-07-02
CVE-2026-57722 WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability — Enable Media Replace CWE-79 5.9 Medium 2026-07-01
CVE-2026-56066 WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerability — ShortPixel Adaptive Images CWE-22 5.8 Medium 2026-06-26
CVE-2026-39471 WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability — ShortPixel Image Optimizer CWE-502 7.2 High 2026-06-15
CVE-2026-5714 Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter — Enable Media Replace CWE-79 6.4 Medium 2026-06-09
CVE-2026-4335 ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title — ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF CWE-79 5.4 Medium 2026-03-26
CVE-2026-2732 Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace — Enable Media Replace CWE-862 5.4 Medium 2026-03-04
CVE-2026-1246 ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter — ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF CWE-22 4.9 Medium 2026-02-05
CVE-2025-11378 ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export — ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF CWE-862 5.4 Medium 2025-10-18
CVE-2025-9496 Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode — Enable Media Replace CWE-79 6.4 Medium 2025-10-11
CVE-2025-6626 ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via API URL — ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization CWE-79 4.4 Medium 2025-08-02
CVE-2025-31081 WordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerability — Enable Media Replace CWE-79 7.1 High 2025-04-01
CVE-2025-30853 WordPress ShortPixel Adaptive Images plugin <= 3.10.0 - Broken Authentication vulnerability — ShortPixel Adaptive Images CWE-862 5.4 Medium 2025-04-01
CVE-2024-48044 WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - Broken Access Control vulnerability — ShortPixel Image Optimizer CWE-862 5.4 Medium 2024-11-01
CVE-2024-48043 WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - SQL Injection vulnerability — ShortPixel Image Optimizer CWE-89 7.6 High 2024-10-17
CVE-2024-5945 WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG — WP SVG Images CWE-79 6.4 Medium 2024-06-21
CVE-2024-35172 WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability — ShortPixel Adaptive Images CWE-918 4.4 Medium 2024-05-13
CVE-2024-4689 WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Cross Site Request Forgery (CSRF) vulnerability — ShortPixel Adaptive Images CWE-352 4.3 Medium 2024-05-10
CVE-2024-32810 WordPress ShortPixel Critical CSS plugin <= 1.0.2 - Broken Access Control vulnerability — ShortPixel Critical CSS CWE-862 7.6 High 2024-05-03
CVE-2024-31230 WordPress ShortPixel Adaptive Images plugin <= 3.8.2 - Broken Access Control vulnerability — ShortPixel Adaptive Images CWE-862 5.3 Medium 2024-04-10
CVE-2023-6737 Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting — Enable Media Replace CWE-79 4.7 Medium 2024-01-11
CVE-2023-32512 WordPress ShortPixel Adaptive Images Plugin <= 3.7.1 is vulnerable to Cross Site Request Forgery (CSRF) — ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization CWE-352 4.3 Medium 2023-11-09
CVE-2022-29417 WordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerability — ShortPixel Adaptive Images (WordPress plugin) CWE-284 4.3 Medium 2022-04-25

This page lists every published CVE security advisory associated with ShortPixel. Each entry links to a detailed page with CVSS scoring, CWE classification, affected products and references. AI-generated Chinese analysis is provided for fast triage.