Shortpixel
20 CVEs across 11 Shortpixel products. Browse Shortpixel vulnerabilities, severities, and proof-of-concept exploits.
Shortpixel products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57342 | Medium | 6.5 | 2026-07-02 | Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions. |
CVE-2026-57722 | Medium | 5.9 | 2026-07-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace allows Stored XSS. This… |
CVE-2026-56066 | Medium | 5.8 | 2026-06-26 | Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions. |
CVE-2026-39471 | High | 7.2 | 2026-06-15 | Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions. |
CVE-2026-5714 | Medium | 6.4 | 2026-06-09 | The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘location_dir’ parameter in all versions up to, and includin… |
CVE-2026-4335 | Medium | 5.4 | 2026-03-26 | The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attachment post_title in all versions up to, and inclu… |
CVE-2026-2732 | Medium | 5.4 | 2026-03-04 | The Enable Media Replace plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'RemoveBackGroundVi… |
CVE-2026-1246 | Medium | 4.9 | 2026-02-05 | The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in all versions up to… |
CVE-2025-11378 | Medium | 5.4 | 2025-10-18 | The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to unauthorized modification of data due to a missing… |
CVE-2025-9496 | Medium | 6.4 | 2025-10-11 | The Enable Media Replace plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's file_modified shortcode in all versions up to, and… |
CVE-2025-6626 | Medium | 4.4 | 2025-08-02 | The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting… |
CVE-2025-31081 | High | 7.1 | 2025-04-01 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace enable-media-replace allo… |
CVE-2025-30853 | Medium | 5.4 | 2025-04-01 | Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Exploiting Incorrectly Configured Access Control… |
CVE-2024-48044 | Medium | 5.4 | 2024-11-01 | Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control… |
CVE-2024-48043 | High | 7.6 | 2024-10-17 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-op… |
CVE-2024-5945 | Medium | 6.4 | 2024-06-21 | The WP SVG Images plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘type’ parameter in all versions up to, and including, 4.3 due to i… |
CVE-2024-4689 | Medium | 4.3 | 2024-05-14 | Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Imag… |
CVE-2024-35172 | Medium | 4.4 | 2024-05-14 | Server-Side Request Forgery (SSRF) vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Ima… |
CVE-2024-32810 | High | 7.6 | 2024-05-03 | Missing Authorization vulnerability in ShortPixel ShortPixel Critical CSS.This issue affects ShortPixel Critical CSS: from n/a through 1.0.2. |
CVE-2024-31230 | Medium | 5.3 | 2024-04-10 | Missing Authorization vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images.This issue affects ShortPixel Adaptive Images: from n/a… |
CVE-2023-6737 | Medium | 4.7 | 2024-01-11 | The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and inc… |
CVE-2023-32512 | Medium | 4.3 | 2023-11-09 | Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin <= 3.7.1 versions. |
CVE-2023-4643 | High | 8.8 | 2023-10-16 | The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PH… |
CVE-2023-0334 | Medium | 6.1 | 2023-02-27 | The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Refle… |
CVE-2023-0255 | High | 8.8 | 2023-02-13 | The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP… |
CVE-2022-2554 | Medium | 4.9 | 2022-10-10 | The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege user… |
CVE-2022-29417 | Medium | 4.3 | 2022-04-25 | Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at WordPress allows an attacker with a low user role like a sub… |