Shortpixel Image Optimizer Optimize Images Convert Webp Avif
Monthly
PHP object injection in the ShortPixel Image Optimizer plugin for WordPress (all versions up to and including 6.5.5) allows an authenticated attacker holding Author-level capability or above to feed attacker-controlled serialized data into the plugin's Replacer and OptimizeAiController code paths, which can instantiate arbitrary PHP objects on the target site. Because the plugin ships no usable POP (property-oriented programming) gadget chain, the flaw has zero security impact on a site where only ShortPixel is installed - exploitation requires the additional presence of a co-installed plugin or theme that supplies a working gadget chain, after which the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit identified at time of analysis; note that our assessed vector (AC:H) is materially less severe than the vendor's 8.8 base score (AC:L), reflecting the mandatory external gadget dependency.
The ShortPixel Image Optimizer WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 6.4.3, affecting the getEditorPopup() function and media-popup.php template. Authenticated attackers with Author-level permissions can inject arbitrary JavaScript into attachment post titles via the REST API, which executes when administrators open the ShortPixel AI editor popup for the poisoned attachment. This vulnerability has a CVSS score of 5.4 (moderate severity) and requires user interaction from a higher-privileged administrator to trigger, limiting its immediate exploitation scope but still presenting a meaningful privilege escalation risk in multi-author WordPress environments.
PHP object injection in the ShortPixel Image Optimizer plugin for WordPress (all versions up to and including 6.5.5) allows an authenticated attacker holding Author-level capability or above to feed attacker-controlled serialized data into the plugin's Replacer and OptimizeAiController code paths, which can instantiate arbitrary PHP objects on the target site. Because the plugin ships no usable POP (property-oriented programming) gadget chain, the flaw has zero security impact on a site where only ShortPixel is installed - exploitation requires the additional presence of a co-installed plugin or theme that supplies a working gadget chain, after which the attacker could delete arbitrary files, retrieve sensitive data, or execute code depending on that chain. No public exploit identified at time of analysis; note that our assessed vector (AC:H) is materially less severe than the vendor's 8.8 base score (AC:L), reflecting the mandatory external gadget dependency.
The ShortPixel Image Optimizer WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to and including 6.4.3, affecting the getEditorPopup() function and media-popup.php template. Authenticated attackers with Author-level permissions can inject arbitrary JavaScript into attachment post titles via the REST API, which executes when administrators open the ShortPixel AI editor popup for the poisoned attachment. This vulnerability has a CVSS score of 5.4 (moderate severity) and requires user interaction from a higher-privileged administrator to trigger, limiting its immediate exploitation scope but still presenting a meaningful privilege escalation risk in multi-author WordPress environments.