Log in Start free

ShortPixel

Products

ProductCVEsExploitedLatest
Enable Media Replace8–Oct 30, 2026
ShortPixel Adaptive Images6–Jul 2, 2026
ShortPixel Image Optimizer5–Oct 8, 2026
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF4–Sep 18, 2026
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization3–Aug 16, 2026
WP SVG Images1–Jun 21, 2024
ShortPixel Adaptive Images (WordPress plugin)1–Apr 25, 2022
ShortPixel Critical CSS1–May 3, 2024

Exploited and recent CVEs

  • CVE-2026-73186 High 8.8 WordPress Enable Media Replace plugin <= 4.2.2 - PHP Object Injection vulnerability 0.4%
  • CVE-2026-85655 Medium 4.3 Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow 0.3%
  • CVE-2026-103070 Medium 6.5 WordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-97246 Medium 4.9 WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability 0.2%
  • CVE-2026-17086 High 8.8 ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content 1.3%
  • CVE-2026-15345 Medium 4.3 ShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter 0.4%
  • CVE-2026-57342 Medium 6.5 WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-57722 Medium 5.9 WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability 0.2%
  • CVE-2026-56066 Medium 5.8 WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerability 0.5%
  • CVE-2026-39471 High 7.2 WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability 0.4%
  • CVE-2026-5714 Medium 6.4 Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter 0.3%
  • CVE-2026-4335 Medium 5.4 ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title 0.2%
  • CVE-2026-2732 Medium 5.4 Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via Background Replace 0.3%
  • CVE-2026-1246 Medium 4.9 ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter 0.6%
  • CVE-2025-11378 Medium 5.4 ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export 0.3%
  • CVE-2025-9496 Medium 6.4 Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcode 0.2%
  • CVE-2025-6626 Medium 4.4 ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via API URL 0.3%
  • CVE-2025-31081 High 7.1 WordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerability 0.4%
  • CVE-2025-30853 Medium 5.4 WordPress ShortPixel Adaptive Images plugin <= 3.10.0 - Broken Authentication vulnerability 0.5%
  • CVE-2024-48044 Medium 5.4 WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - Broken Access Control vulnerability 0.4%
  • CVE-2024-48043 High 7.6 WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - SQL Injection vulnerability 0.4%
  • CVE-2024-5945 Medium 6.4 WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVG 0.3%
  • CVE-2024-35172 Medium 4.4 WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerability 0.4%
  • CVE-2024-4689 Medium 4.3 WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Cross Site Request Forgery (CSRF) vulnerability 0.2%
  • CVE-2024-32810 High 7.6 WordPress ShortPixel Critical CSS plugin <= 1.0.2 - Broken Access Control vulnerability 0.4%
  • CVE-2024-31230 Medium 5.3 WordPress ShortPixel Adaptive Images plugin <= 3.8.2 - Broken Access Control vulnerability 0.4%
  • CVE-2023-6737 Medium 4.7 Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scripting 0.5%
  • CVE-2023-32512 Medium 4.3 WordPress ShortPixel Adaptive Images Plugin <= 3.7.1 is vulnerable to Cross Site Request Forgery (CSRF) 0.3%
  • CVE-2022-29417 Medium 4.3 WordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerability 0.6%