EUVD-2026-16087
GHSA-g8cg-xh22-8v5v
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
The ShortPixel Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the attachment post_title in all versions up to, and including, 6.4.3. This is due to insufficient output escaping in the getEditorPopup() function and its corresponding media-popup.php template. Specifically, the attachment's post_title is retrieved from the database via get_post() in AjaxController.php (line 435) and passed directly to the view template (line 449), where it is rendered into an HTML input element's value attribute without esc_attr() escaping (media-popup.php line 139). Since WordPress allows Authors to set arbitrary attachment titles (including double-quote characters) via the REST API, a malicious author can craft an attachment title that breaks out of the HTML attribute and injects arbitrary JavaScript event handlers. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts that execute whenever a higher-privileged user (such as an administrator) opens the ShortPixel AI editor popup (Background Removal or Image Upscale) for the poisoned attachment.
AnalysisAI
The ShortPixel Image Optimizer WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 6.4.3, affecting the getEditorPopup() function and media-popup.php template. Authenticated attackers with Author-level permissions can inject arbitrary JavaScript into attachment post titles via the REST API, which executes when administrators open the ShortPixel AI editor popup for the poisoned attachment. This vulnerability has a CVSS score of 5.4 (moderate severity) and requires user interaction from a higher-privileged administrator to trigger, limiting its immediate exploitation scope but still presenting a meaningful privilege escalation risk in multi-author WordPress environments.
Technical ContextAI
The vulnerability stems from improper output encoding in a PHP-based WordPress plugin. The ShortPixel Image Optimizer plugin (CPE: cpe:2.3:a:shortpixel:shortpixel_image_optimizer_-_optimize_images,_convert_webp_&_avif:*:*:*:*:*:*:*:*) retrieves attachment post titles from the WordPress database using the get_post() function in AjaxController.php (line 449), then passes this data directly to the media-popup.php template without sanitization. The template renders this value into an HTML input element's value attribute (line 139) without applying the esc_attr() escaping function, which is the standard WordPress function for escaping attribute content. This represents a classic CWE-79 (Improper Neutralization of Input During Web Page Generation - 'Cross-site Scripting') vulnerability where user-supplied data is rendered in an HTML context without proper encoding. The attack surface is expanded by WordPress's REST API, which permits Author-level users to modify attachment metadata including post titles with arbitrary characters such as double quotes that can break out of HTML attributes.
RemediationAI
The primary remediation is to upgrade the ShortPixel Image Optimizer plugin to a version newer than 6.4.3 immediately, as this version is confirmed vulnerable. Site administrators should navigate to their WordPress plugin dashboard, locate ShortPixel Image Optimizer, and update to the latest available version. The vulnerability details and official patch information are available via the Wordfence vulnerability database (https://www.wordfence.com/threat-intel/vulnerabilities/id/a156234f-2644-4d17-aaa5-4f088cf48f73?source=cve) and the WordPress plugin repository changeset tracking. As an interim workaround pending patching, administrators should restrict Author-level user access to media upload and editing functionality to trusted internal staff only, and minimize the number of users with Author permissions in multi-user environments. Additionally, administrators should audit recent attachment uploads and modifications by Author-level users for suspicious post titles containing special characters or JavaScript event handlers. Security-conscious sites may also disable the ShortPixel AI editor features (Background Removal, Image Upscale) via plugin settings until patching is confirmed, as these features specifically trigger the vulnerable code path.
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today