SH
Vendor
shortpixel
19
CVEs
0
On KEV
3
New 30D
Products
SI7.2
ShortPixel Image Optimizer
ShortPixel
3 CVEs0 on KEV2 new
EM8.8
Enable Media Replace
shortpixel
7 CVEs0 on KEV1 new
SA8.8
ShortPixel Adaptive Images
ShortPixel
5 CVEs0 on KEV0 new
SI8.8
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
shortpixel
2 CVEs0 on KEV0 new
IO8.8
Image Optimizer
Shortpixel
1 CVEs0 on KEV0 new
SA4.3
ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization
shortpixel
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-85655 New | EM Enable Media Replace shortpixel | 4.3 | Oct 28 | Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow |
| CVE-2026-103070 | SI ShortPixel Image Optimizer ShortPixel | 6.5 | Oct 8 | WordPress ShortPixel Image Optimizer plugin <= 6.5.6 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-97246 | SI ShortPixel Image Optimizer ShortPixel | 4.9 | Sep 30 | WordPress ShortPixel Image Optimizer plugin <= 6.5.5 - PHP Object Injection vulnerability |
| CVE-2026-17086 | SI ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF shortpixel | 8.8 | Sep 18 | ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content |
| CVE-2026-15345 | SA ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization shortpixel | 4.3 | Aug 16 | ShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter |
| CVE-2026-57342 | SA ShortPixel Adaptive Images ShortPixel | 6.5 | Jul 2 | WordPress ShortPixel Adaptive Images plugin <= 3.11.3 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-57722 | EM Enable Media Replace ShortPixel | 5.9 | Jul 1 | WordPress Enable Media Replace plugin <= 4.2.1 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-56066 | SA ShortPixel Adaptive Images ShortPixel | 5.8 | Jun 26 | WordPress ShortPixel Adaptive Images plugin <= 3.11.4 - Arbitrary File Deletion vulnerability |
| CVE-2026-39471 | SI ShortPixel Image Optimizer ShortPixel | 7.2 | Jun 15 | WordPress ShortPixel Image Optimizer plugin <= 6.4.3 - PHP Object Injection vulnerability |
| CVE-2026-5714 | EM Enable Media Replace shortpixel | 6.4 | Jun 9 | Enable Media Replace <= 4.1.8 - Authenticated (Author+) Stored Cross-Site Scripting via 'location_dir' Parameter |
| CVE-2026-4335 | SI ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF shortpixel | 5.4 | Mar 26 | ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title |
| CVE-2024-48044 | IO Image Optimizer Shortpixel | 8.8 | Nov 1 | Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security… |
| CVE-2023-6737 | EM Enable Media Replace Shortpixel | 6.1 | Jan 11 | The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to… |
| CVE-2023-32512 | SA Shortpixel Adaptive Images Shortpixel | 8.8 | Nov 9 | Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin <= 3.7.1 versions |
| CVE-2023-4643 | EM Enable Media Replace Shortpixel | 8.8 | Oct 16 | The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection… |
| CVE-2023-0334 | SA Shortpixel Adaptive Images Shortpixel | 6.1 | Feb 27 | The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site… |
| CVE-2023-0255 | EM Enable Media Replace Shortpixel | 8.8 | Feb 13 | The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected… |
| CVE-2022-2554 | EM Enable Media Replace Shortpixel | 4.9 | Oct 10 | Enable Media Replace < 4.0.0 - Admin+ Path Traversal |
| CVE-2022-29417 | SA Shortpixel Adaptive Images Shortpixel | 4.3 | Apr 25 | Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at WordPress allows an attacker with a low user role like a subscriber or higher to… |