Shortpixel vulnerabilities
29 CVEs and advisories name Shortpixel as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-73186WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability
- CVE-2026-85655Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow
- CVE-2026-103070WordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-97246WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability
- CVE-2026-17086ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
- CVE-2026-15345ShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter
- CVE-2026-57342WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-57722WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability
- CVE-2026-56066WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerability
- CVE-2026-39471WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability
- CVE-2026-5714Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter
- CVE-2026-4335ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title
- CVE-2026-2732Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace
- CVE-2026-1246ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter
- CVE-2025-11378ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export
- CVE-2025-9496Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode
- CVE-2025-6626ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via API URL
- CVE-2025-31081WordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerability
- CVE-2025-30853WordPress ShortPixel Adaptive Images plugin <= 3.10.0 - Broken Authentication vulnerability
- CVE-2024-48044WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - Broken Access Control vulnerability
- CVE-2024-48043WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - SQL Injection vulnerability
- CVE-2024-5945WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG
- CVE-2024-35172WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability
- CVE-2024-4689WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-32810WordPress ShortPixel Critical CSS plugin <= 1.0.2 - Broken Access Control vulnerability
- CVE-2024-31230WordPress ShortPixel Adaptive Images plugin <= 3.8.2 - Broken Access Control vulnerability
- CVE-2023-6737Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting
- CVE-2023-32512WordPress ShortPixel Adaptive Images Plugin <= 3.7.1 is vulnerable to Cross Site Request Forgery (CSRF)
- CVE-2022-29417WordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerability