TinyPNG
Products
| Product | CVEs | Exploited | Latest |
|---|---|---|---|
| TinyPNG | 1 | – | Oct 5, 2024 |
| TinyPNG – JPEG, PNG & WebP image compression | 1 | – | Jul 2, 2026 |
Exploited and recent CVEs
- CVE-2026-7311 TinyPNG <= 3.6.13 - Authenticated (Author+) Arbitrary File Deletion via 'convert.path' in 'tiny_compress_images' Post Meta 1.0%
- CVE-2024-47635 WordPress TinyPNG plugin <= 3.4.3 - Cross Site Request Forgery (CSRF) vulnerability 0.2%