ShortPixel Image Optimizer EUVD-2026-94944

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) capable of reaching a ShortPixel Image Optimizer input that is improperly neutralized, plus a separate victim with a higher privilege level who must view the affected page for the stored payload to fire (UI:R). Limiting factors: attacker must already hold a valid account on the target site, the payload only achieves impact when a privileged user renders the injected content, and the plugin must be installed and active (versions through 6.5.6). This is not remotely exploitable by an unauthenticated attacker against a default install.

This is a moderate-severity stored XSS (CWE-79) in the ShortPixel Image Optimizer WordPress plugin. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) indicates network-reachable but authenticated (PR:L) exploitation that additionally requires victim user interaction (UI:R), with a scope change (S:C) reflecting that injected script executes in a different security context (e.g. an administrator's browser session). No EPSS score, CISA KEV listing, or public POC was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - the two signals that would elevate this above routine patching priority are both absent. The scope-change plus the real-world popularity of the plugin make this a worthwhile but not emergency fix; it is a credible targeted-abuse vector (a low-privileged contributor/author escalating against an admin) rather than a mass-exploitable unauthenticated RCE. Note one inconsistency to verify: the input vector lists A:L (availability impact), which is atypical for stored XSS - most stored XSS has no genuine availability impact - so the authored availability metric should be treated with caution.

A low-privileged authenticated WordPress user (e.g. a contributor or author) submits a crafted payload through a ShortPixel Image Optimizer input field that is not properly neutralized, persisting malicious JavaScript in the site. When a higher-privileged user such as an administrator later views the affected page in wp-admin, the stored script executes in their browser (UI:R), enabling session theft or admin actions on their behalf. No public exploit code is identified at time of analysis.