# cve.now: Shortpixel

The newest entries naming Shortpixel as an affected vendor (up to 200), of 29 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-73186](https://cve.now/CVE-2026-73186.md): WordPress Enable Media Replace plugin \<= 4.2.2 - PHP Object Injection vulnerability (CVSS 8.8)
- [CVE-2026-85655](https://cve.now/CVE-2026-85655.md): Enable Media Replace \<= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow (CVSS 4.3)
- [CVE-2026-103070](https://cve.now/CVE-2026-103070.md): WordPress ShortPixel Image Optimizer plugin \<= 6.5.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-97246](https://cve.now/CVE-2026-97246.md): WordPress ShortPixel Image Optimizer plugin \<= 6.5.5 - PHP Object Injection vulnerability (CVSS 4.9)
- [CVE-2026-17086](https://cve.now/CVE-2026-17086.md): ShortPixel Image Optimizer \<= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content (CVSS 8.8)
- [CVE-2026-15345](https://cve.now/CVE-2026-15345.md): ShortPixel Adaptive Images \<= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter (CVSS 4.3)
- [CVE-2026-57342](https://cve.now/CVE-2026-57342.md): WordPress ShortPixel Adaptive Images plugin \<= 3.11.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2026-57722](https://cve.now/CVE-2026-57722.md): WordPress Enable Media Replace plugin \<= 4.2.1 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9)
- [CVE-2026-56066](https://cve.now/CVE-2026-56066.md): WordPress ShortPixel Adaptive Images plugin \<= 3.11.4 - Arbitrary File Deletion vulnerability (CVSS 5.8)
- [CVE-2026-39471](https://cve.now/CVE-2026-39471.md): WordPress ShortPixel Image Optimizer plugin \<= 6.4.3 - PHP Object Injection vulnerability (CVSS 7.2)
- [CVE-2026-5714](https://cve.now/CVE-2026-5714.md): Enable Media Replace \<= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location\_dir' Parameter (CVSS 6.4)
- [CVE-2026-4335](https://cve.now/CVE-2026-4335.md): ShortPixel Image Optimizer \<= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title (CVSS 5.4)
- [CVE-2026-2732](https://cve.now/CVE-2026-2732.md): Enable Media Replace \<= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace (CVSS 5.4)
- [CVE-2026-1246](https://cve.now/CVE-2026-1246.md): ShortPixel Image Optimizer \<= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter (CVSS 4.9)
- [CVE-2025-11378](https://cve.now/CVE-2025-11378.md): ShortPixel Image Optimizer \<= 6.3.4 - Authenticated (Contributor+) Settings Import/Export (CVSS 5.4)
- [CVE-2025-9496](https://cve.now/CVE-2025-9496.md): Enable Media Replace \<= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file\_modified Shortcode (CVSS 6.4)
- [CVE-2025-6626](https://cve.now/CVE-2025-6626.md): ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization \<= 3.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via API URL (CVSS 4.4)
- [CVE-2025-31081](https://cve.now/CVE-2025-31081.md): WordPress Enable Media Replace plugin \<= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1)
- [CVE-2025-30853](https://cve.now/CVE-2025-30853.md): WordPress ShortPixel Adaptive Images plugin \<= 3.10.0 - Broken Authentication vulnerability (CVSS 5.4)
- [CVE-2024-48044](https://cve.now/CVE-2024-48044.md): WordPress ShortPixel Image Optimizer plugin \<= 5.6.3 - Broken Access Control vulnerability (CVSS 5.4)
- [CVE-2024-48043](https://cve.now/CVE-2024-48043.md): WordPress ShortPixel Image Optimizer plugin \<= 5.6.3 - SQL Injection vulnerability (CVSS 7.6)
- [CVE-2024-5945](https://cve.now/CVE-2024-5945.md): WP SVG Images \<= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG (CVSS 6.4)
- [CVE-2024-35172](https://cve.now/CVE-2024-35172.md): WordPress ShortPixel Adaptive Images plugin \<= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability (CVSS 4.4)
- [CVE-2024-4689](https://cve.now/CVE-2024-4689.md): WordPress ShortPixel Adaptive Images plugin \<= 3.8.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3)
- [CVE-2024-32810](https://cve.now/CVE-2024-32810.md): WordPress ShortPixel Critical CSS plugin \<= 1.0.2 - Broken Access Control vulnerability (CVSS 7.6)
- [CVE-2024-31230](https://cve.now/CVE-2024-31230.md): WordPress ShortPixel Adaptive Images plugin \<= 3.8.2 - Broken Access Control vulnerability (CVSS 5.3)
- [CVE-2023-6737](https://cve.now/CVE-2023-6737.md): Enable Media Replace \<= 4.1.4 - Reflected Cross-Site Scripting (CVSS 4.7)
- [CVE-2023-32512](https://cve.now/CVE-2023-32512.md): WordPress ShortPixel Adaptive Images Plugin \<= 3.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3)
- [CVE-2022-29417](https://cve.now/CVE-2022-29417.md): WordPress ShortPixel Adaptive Images plugin \<= 3.3.1 - Subscriber+ Plugin Settings Update vulnerability (CVSS 4.3)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/shortpixel
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.