plugin
15 known security issues reported for the Wp Smushit WordPress plugin. Most recent disclosed Mar 29, 2025.
Running Wp Smushit on your site? Check whether your installed version is affected.
Scan your site freeThe Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP & AVIF | Image CDN plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.17.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to perform...
[en] The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media L...
The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Librar...
[en] The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malici...
The Smush – Lazy Load Images, Optimize & Compress Images plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'name' and 'description' parameters in versions up to, and including, 3.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacke...
The Smush – Lazy Load Images, Optimize & Compress Images plugin for WordPress is vulnerable to Cross-Site Scripting leading in versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject malicious web scripts into the application.
The Smush – Lazy Load Images, Optimize & Compress Images plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 3.0.0. This makes it possible for authenticated attackers to call files using a PHAR wrapper that will deserialize the data and cal...
Authenticated XSS & Phar Deserialization vulnerabilities found by RIPS Technologies in WordPress Smush Image Compression and Optimization plugin (versions <= 2.9.1).
The Smush – Lazy Load Images, Optimize & Compress Images plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 3.0.0. This makes it possible for authenticated attackers to call files using a PHAR wrapper that will deserialize the data and cal...
The Smush – Lazy Load Images, Optimize & Compress Images plugin for WordPress is vulnerable to Cross-Site Scripting leading in versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject malicious web scripts into the application.
File Traversal vulnerability found by Ricardo Sánchez in WordPress Smush Image Compression and Optimization plugin (versions <=2.7.5).
[en] The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.
The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.
The Smush – Lazy Load Images, Optimize & Compress Images WordPress plugin was affected by an Authenticated Phar Deserialization security vulnerability.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free