彙總 shortpixel 相關全部產品的 CVE 與安全漏洞情報，包括 CVSS、EPSS、公開時間與漏洞情報資料。
常見弱點模式包括 跨站腳本、CSRF與路徑處理缺陷，在 生產負載與軟體部署 使用場景中可能帶來 檔案覆寫與工作階段劫持 等風險。
相關漏洞資料主要來源於公開漏洞披露與安全公告，可用於評估歷史漏洞暴露面與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2024-48044 | Missing Authorization vulnerability in ShortPixel ShortPixel Image Optimizer shortpixel-image-optimiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShortPixel Image Optimizer: from n/a through <= 5.6.3. | [email protected] | 5.4 | 0.38% | 2024-11-01 | 2026-06-17 |
| CVE-2023-6737 | The Enable Media Replace plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the SHORTPIXEL_DEBUG parameter in all versions up to, and including, 4.1.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploiting this vulnerability requires the attacker to know the ID o | [email protected] | 4.7 | 0.49% | 2024-01-11 | 2026-06-17 |
| CVE-2023-32512 | Cross-Site Request Forgery (CSRF) vulnerability in ShortPixel ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin <= 3.7.1 versions. | [email protected] | 4.3 | 0.31% | 2023-11-09 | 2026-06-17 |
| CVE-2023-4643 | The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog | [email protected] | 8.8 | 0.84% | 2023-10-16 | 2026-06-17 |
| CVE-2023-0334 | The ShortPixel Adaptive Images WordPress plugin before 3.6.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against any high privilege users such as admin | [email protected] | 6.1 | 0.88% | 2023-02-27 | 2026-06-17 |
| CVE-2023-0255 | The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites. | [email protected] | 8.8 | 1.10% | 2023-02-13 | 2026-06-17 |
| CVE-2022-2554 | The Enable Media Replace WordPress plugin before 4.0.0 does not ensure that renamed files are moved to the Upload folder, which could allow high privilege users such as admin to move them outside to the web root directory via a path traversal attack for example | [email protected] | 4.9 | 0.78% | 2022-10-10 | 2026-06-17 |
| CVE-2022-29417 | Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin <= 3.3.1 at WordPress allows an attacker with a low user role like a subscriber or higher to change the plugin settings. | [email protected] | 4.3 | 0.58% | 2022-04-25 | 2026-06-17 |