ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF

Information

Software Type Plugin
Software Slug shortpixel-image-optimiser (view on wordpress.org)
Software Status Active
Software Author shortpixel
Software Website shortpixel.com
Software Downloads 19,791,769
Software Active Installs 300,000
Software Record Last Updated August 18, 2026

8 Vulnerabilities

Submit a Vulnerability
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.4.3 - Authenticated (Author+) PHP Object Injection
7.5
CVE-2026-39471
Apr 20, 2026
Researcher: daroo
ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title
5.4
CVE-2026-4335
Mar 25, 2026
Researcher: daroo
ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter
4.9
CVE-2026-1246
Feb 4, 2026
Researcher: 0N0ise
ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export
5.4
CVE-2025-11378
Oct 17, 2025
Researcher: Dmitrii Ignatyev
ShortPixel Image Optimizer <= 5.6.3 - Missing Authorization
4.3
CVE-2024-48044
Oct 13, 2024
Researcher: Rafie Muhammad
ShortPixel Image Optimizer <= 5.6.3 - Authenticated (Editor+) SQL Injection
4.9
CVE-2024-48043
Oct 13, 2024
Researcher: Rafie Muhammad
ShortPixel Image Optimizer <= 5.4.1 - Authenticated(Editor+) PHP Object Injection
6.6
CVE ID Unknown
Sep 14, 2023
Researchers:
ShortPixel Image Optimizer <= 4.22.9 - Reflected Cross-Site Scripting
6.1
CVE ID Unknown
Jun 2, 2022
Researcher: WPScanTeam
Title Status CVE ID CVSS Researchers Date
ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF <= 6.4.3 - Authenticated (Author+) PHP Object Injection Patched CVE-2026-39471 7.5 daroo April 20, 2026
ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title Patched CVE-2026-4335 5.4 daroo March 25, 2026
ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter Patched CVE-2026-1246 4.9 0N0ise February 4, 2026
ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export Patched CVE-2025-11378 5.4 Dmitrii Ignatyev October 17, 2025
ShortPixel Image Optimizer <= 5.6.3 - Missing Authorization Patched CVE-2024-48044 4.3 Rafie Muhammad October 13, 2024
ShortPixel Image Optimizer <= 5.6.3 - Authenticated (Editor+) SQL Injection Patched CVE-2024-48043 4.9 Rafie Muhammad October 13, 2024
ShortPixel Image Optimizer <= 5.4.1 - Authenticated(Editor+) PHP Object Injection Patched 6.6 September 14, 2023
ShortPixel Image Optimizer <= 4.22.9 - Reflected Cross-Site Scripting Patched 6.1 WPScanTeam June 2, 2022

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation