ShortPixel Image Optimizer vulnerabilities

Latest ShortPixel Image Optimizer CVEs

Newest publication first

1. CVE-2026-103070 WordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (XSS) vulnerability

   Published 2026-10-08

   Medium·CVSS 6.5 EPSS 0.16%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Stored XSS.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.6.

2. CVE-2026-97246 WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability

   Published 2026-09-30

   Medium·CVSS 4.9 EPSS 0.21%

   Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5.

3. CVE-2026-39471 WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability

   Published 2026-06-15

   High·CVSS 7.2 EPSS 0.45%

   Author PHP Object Injection in ShortPixel Image Optimizer <= 6.4.3 versions.

4. CVE-2024-48044 WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - Broken Access Control vulnerability

   Published 2024-11-01

   High·CVSS 8.8 EPSS 0.39%

   Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.

5. CVE-2024-48043 WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - SQL Injection vulnerability

   Published 2024-10-17

   High·CVSS 7.6 EPSS 0.45%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Blind SQL Injection.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.