ShortPixel vulnerabilities
We track 5 vulnerabilities in ShortPixel products across 6 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on September 18, 2026.
Latest ShortPixel vulnerabilities
- 8.8 High severity
ShortPixel Image Optimizer – Optimize Images…: Deserialization of Untrusted Data
The ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 6.5.5 via deserialization of untrusted input . This makes it possible for authenticated attac
- 7.1 High severity
Enable Media Replace: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel Enable Media Replace enable-media-replace allows Reflected XSS.This issue affects Enable Media Replace: from n/a through <= 4.1.5.
- 8.8 High severity
ShortPixel Image Optimizer: Missing Authorization
Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3.
- 7.6 High severity
ShortPixel Image Optimizer: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Blind SQL Injection.This issue affects ShortPixel Image Optimizer: from n/a through <=
- 8.8 High severity
ShortPixel Adaptive Images – WebP, AVIF, CDN…: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin <= 3.7.1 versions.