Advisories · Technology

ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF.

Every CVE that names ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-17086 CVE record

CVSS 8.8 High

ShortPixel Image Optimizer <= 6.5.5 - Authenticated (Author+) PHP Object Injection via Nested JSON Post Content
- ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
- Insecure deserialization
Not analysed yet 18 Sept 2026
CVE-2026-4335 CVE record

CVSS 5.4 Medium

ShortPixel Image Optimizer <= 6.4.3 - Authenticated (Author+) Stored Cross-Site Scripting via Attachment Title
- ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
- Cross-site scripting (XSS)
Not analysed yet 26 Mar 2026
CVE-2026-1246 CVE record

CVSS 4.9 Medium

ShortPixel Image Optimizer <= 6.4.2 - Authenticated (Editor+) Arbitrary File Read via 'loadFile' Parameter
- ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
- Path traversal
Not analysed yet 5 Feb 2026
CVE-2025-11378 CVE record

CVSS 5.4 Medium

ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export
- ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF
- Broken access control
Not analysed yet 18 Oct 2025