Threat Database

Threat Entry Updated 2026-11-07

Wp Smushit - Security Vulnerability (CVE-2026-120845)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV Smush Image Compression and Optimization wp-smushit allows Stored XSS.This issue affects Smush Image Compression and Optimization: from n/a through 4.3.5.

PLUGIN Wp Smushit

CVE-2026-120845

MEDIUM CVSS 6.5 2026-11-06

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Wp Smushit - Broken Access Control (CVE-2023-3352)

The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library.

PLUGIN Wp Smushit

CVE-2023-3352

MEDIUM CVSS 4.3 2024-06-21

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-06-17

Wp Smushit - Path Traversal (CVE-2017-15079)

The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.

PLUGIN Wp Smushit

CVE-2017-15079

HIGH CVSS 7.5 2017-10-06

Risk Score

Open Full Technical Breakdown