ShortPixel
Vulnerability activity for ShortPixel: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 2
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 5
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 6
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Exploited now
None of this vendor's CVEs are on CISA's known-exploited list.
Recent
- 8.8HighOct 30, 2026ShortPixel Enable Media Replace DeserializationCVE-2026-73186Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.
- 4.3MediumOct 28, 2026Shortpixel Enable Media Replace Auth bypass / access controlCVE-2026-85655The Enable Media Replace plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with author-level access and above, to modify the post_content of any published post referencing the replaced media — including Administrator-owned posts — making changes immediately visible to unauthenticated visitors. Th
- 6.5MediumOct 8, 2026ShortPixel Image Optimizer XSSCVE-2026-103070Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Stored XSS.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.6.
- 4.9MediumSep 30, 2026ShortPixel Image Optimizer DeserializationCVE-2026-97246Deserialization of Untrusted Data vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Object Injection.This issue affects ShortPixel Image Optimizer: from n/a through 6.5.5.
- 8.8HighSep 18, 2026ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF DeserializationCVE-2026-17086The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on t
- 5.8MediumJun 26, 2026ShortPixel Adaptive Images Path traversal / file handlingCVE-2026-56066Unauthenticated Arbitrary File Deletion in ShortPixel Adaptive Images <= 3.11.4 versions.
Top products
- ShortPixel Image Optimizer2 CVEs in the last year
- Enable Media Replace2 CVEs in the last year
- ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF1 CVE in the last year
- ShortPixel Adaptive Images1 CVE in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.