Cross-Site Scripting Vulnerability in ShortPixel Image Optimizer by ShortPixel
CVE-2026-103070

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Shortpixel Image Optimizer
Vendor
CVE Published:
8 October 2026

What is CVE-2026-103070?

A Cross-Site Scripting (XSS) vulnerability has been identified in the ShortPixel Image Optimizer plugin, which may allow attackers to inject malicious scripts into web pages viewed by users. This flaw affects versions up to 6.5.6 of the plugin, enabling potentially harmful actions when these pages are accessed. It is crucial for users of ShortPixel Image Optimizer to ensure they are updated to a secure version to mitigate risks associated with this vulnerability.

Affected Version(s)

ShortPixel Image Optimizer 0 <= 6.5.6

References

https://patchstack.com/database/wordpress/plugin/shortpix...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Intrudify | Patchstack Bug Bounty Program
.