plugin
9 known security issues reported for the Squeeze WordPress plugin. Most recent disclosed Aug 6, 2026.
Running Squeeze on your site? Check whether your installed version is affected.
Scan your site freeThe Squeeze plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to, and including, 1.7.11. This is due to missing file type validation. This makes it possible for authenticated attackers, with author-level access and above, to upload arbitrary files on the affected site's server, which may make r...
[en] Path Traversal: '.../...//' vulnerability in Bogdan Bendziukov Squeeze squeeze allows Path Traversal.This issue affects Squeeze: from n/a through <= 1.7.7.
The Squeeze – Image Optimization & Compression, WEBP Conversion plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.7.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform actions on files outside of the originally intende...
The Squeeze – Image Optimization & Compression, WebP Conversion plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.6. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary f...
The Squeeze – Image Optimization & Compression, WebP Conversion plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to retrieve the full path of the web application, which can be used to aid other attacks. The informa...
[en] Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in Bogdan Bendziukov Squeeze allows Retrieve Embedded Sensitive Data. This issue affects Squeeze: from n/a through 1.6.
[en] Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze allows Using Malicious Files. This issue affects Squeeze: from n/a through 1.6.
[en] Unrestricted Upload of File with Dangerous Type vulnerability in Bogdan Bendziukov Squeeze allows Code Injection.This issue affects Squeeze: from n/a through 1.4.
The Squeeze plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 1.4. This makes it possible for authenticated attackers, with administrator-level access and above, to upload arbitrary files on the affected site's server which may make re...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free