shortpixel has 4 CVEs on record. 4 were published in the last 90 days. The median CVSS is 5.7 (medium). Most affected products: shortpixel-image-optimiser (2), Enable Media Replace (1), ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.7
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Products
- shortpixel-image-optimiser 2
- Enable Media Replace 1
- ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF 1
Worst active — by depth score
CVE-2026-17086High· 8.8The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input 49CVE-2026-103070Medium· 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Stored XSS.This issue affects ShortPixel Image Optimizer: from …36CVE-2026-97246Medium· 4.9Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions.27CVE-2026-85655Medium· 4.3Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow24
shortpixel vulnerabilities
CVEs affecting shortpixel, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-85655Medium· 4.3Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow
The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes …
CVE-2026-103070Medium· 6.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Stored XSS.This issue affects ShortPixel Image Optimizer: from …
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Stored XSS.This issue affects ShortPixel Image Optimizer: from …
CVE-2026-97246Medium· 4.9Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions.
Subscriber PHP Object Injection in ShortPixel Image Optimizer <= 6.5.5 versions.
CVE-2026-17086High· 8.8The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible …