CVEs we hold for Shortpixel
Records whose assigning authority named Shortpixel as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-57722WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerabilityShortPixel Enable Media Replace
CVE-2026-57342WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerabilityShortPixel Adaptive Images
CVE-2026-5714Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parametershortpixel Enable Media Replace
CVE-2026-56066WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerabilityShortPixel Adaptive Images
CVE-2026-4335ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment TitleShortPixel Image Optimizer – Optimize Images, Convert WebP…
CVE-2026-39471WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerabilityShortPixel Image Optimizer
CVE-2026-2732Enable Media Replace <= 4.1.7 - Improper Authorization to Authenticated (Author+) Arbitrary Attachment Change via…shortpixel Enable Media Replace
CVE-2026-17086ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post ContentShortPixel Image Optimizer – Optimize Images, Convert WebP…
CVE-2026-15345ShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option…ShortPixel Adaptive Images – WebP, AVIF, CDN, Image…
CVE-2026-1246ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' ParameterShortPixel Image Optimizer – Optimize Images, Convert WebP…
CVE-2025-9496Enable Media Replace <= 4.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via file_modified Shortcodeshortpixel Enable Media Replace
CVE-2025-6626ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization <= 3.10.4 - Authenticated (Administrator+) Stored…ShortPixel Adaptive Images – WebP, AVIF, CDN, Image…
CVE-2025-31081WordPress Enable Media Replace plugin <= 4.1.5 - Reflected Cross Site Scripting (XSS) vulnerabilityShortPixel Enable Media Replace
CVE-2025-30853WordPress ShortPixel Adaptive Images plugin <= 3.10.0 - Broken Authentication vulnerabilityShortPixel Adaptive Images
CVE-2025-11378ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/ExportShortPixel Image Optimizer – Optimize Images, Convert WebP…
CVE-2024-5945WP SVG Images <= 4.3 - Authenticated (Author+) Stored Cross-Site Scripting via SVGshortpixel WP SVG Images
CVE-2024-48044WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - Broken Access Control vulnerabilityShortPixel Image Optimizer
CVE-2024-48043WordPress ShortPixel Image Optimizer plugin <= 5.6.3 - SQL Injection vulnerabilityShortPixel Image Optimizer
CVE-2024-4689WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Cross Site Request Forgery (CSRF) vulnerabilityShortPixel Adaptive Images
CVE-2024-35172WordPress ShortPixel Adaptive Images plugin <= 3.8.3 - Server Side Request Forgery (SSRF) vulnerabilityShortPixel Adaptive Images
CVE-2024-32810WordPress ShortPixel Critical CSS plugin <= 1.0.2 - Broken Access Control vulnerabilityShortPixel Critical CSS
CVE-2024-31230WordPress ShortPixel Adaptive Images plugin <= 3.8.2 - Broken Access Control vulnerabilityShortPixel Adaptive Images
CVE-2023-6737Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scriptingshortpixel Enable Media Replace
CVE-2023-32512WordPress ShortPixel Adaptive Images Plugin <= 3.7.1 is vulnerable to Cross Site Request Forgery (CSRF)ShortPixel Adaptive Images – WebP, AVIF, CDN, Image…
CVE-2022-29417WordPress ShortPixel Adaptive Images plugin <= 3.3.1 - Subscriber+ Plugin Settings Update vulnerabilityShortPixel Adaptive Images (WordPress plugin)
26 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.