Threat Entry Updated 2026-03-30

CVE-2026-4335 - Shortpixel Image Optimiser Plugin

The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attachment post_title in all versions up to, and including, 6.4.3. This is due to insufficient output escaping in the getEditorPopup() function and its corresponding media-popup.php template. Specifically, the attachment's post_title is retrieved from the database via get_post() in AjaxController.php (line 435) and passed directly to the view template (line 449), where it is rendered into an HTML input element's value attribute without esc_attr() escaping (media-popup.php line 139). Since WordPress allows Authors to set arbitrary attachment…

PLUGIN Shortpixel Image Optimiser

CVE-2026-4335

MEDIUM CVSS 5.4 2026-03-26

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-04-15

CVE-2026-1246 - Shortpixel Image Optimiser Plugin

The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Read via path traversal in the 'loadFile' parameter in all versions up to, and including, 6.4.2 due to insufficient path validation and sanitization in the 'loadLogFile' AJAX action. This makes it possible for authenticated attackers, with Editor-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information such as database credentials and authentication keys.

PLUGIN Shortpixel Image Optimiser

CVE-2026-1246

MEDIUM CVSS 4.9 2026-02-05

Risk Score

Open Full Technical Breakdown