WordPress plugin
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 11 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical1
- High3
- Medium5
- Low2
All Smush – Image Optimization, Compression, Lazy Load, WebP & CDN vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| Medium4.3 | Authenticated (Author+) Insecure Direct Object Reference <4.3.6Update to 4.3.6 | CVE-2026-118241 | |
| Medium6.4 | Authenticated (Contributor+) Stored Cross-Site Scripting ≤4.3.5Update to 4.3.6 | CVE-2026-120845 | |
| Low2.7 | Missing Authorization ≤4.3.3Update to 4.3.4 | CVE-2026-110039 | |
| High7.5 | Unauthenticated Denial of Service ≤4.2.0Update to 4.3.0 | CVE-2026-81285 | |
| High7.2 | Authenticated (Administrator+) Remote Code Execution <4.3.2Update to 4.3.2 | CVE-2026-19223 | |
| Low2.7 | Authenticated (Admin+) Directory Traversal ≤3.17.0Update to 3.17.1 | CVE-2025-22288 | |
| Medium4.3 | Missing Authorization to Resmush List Deletion ≤3.16.4Update to 3.16.5 | CVE-2023-3352 | |
| Medium4.4 | Cross-Site Scripting ≤3.9.8Update to 3.9.9 | CVE-2022-1009 | |
| Critical9.8 | Cross-Site Scripting ≤2.9.1Update to 3.0.0 | — | |
| High8.8 | Authenticated PHAR Deserialization ≤3.0.0Update to 3.0.1 | — | |
| Medium5.3 | Directory Traversal ≤2.7.5Update to 2.7.6 | CVE-2017-15079 |
- Medium4.3Authenticated (Author+) Insecure Direct Object Reference
<4.3.6Update to 4.3.6
- Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤4.3.5Update to 4.3.6
- Low2.7Missing Authorization
≤4.3.3Update to 4.3.4
- High7.5Unauthenticated Denial of Service
≤4.2.0Update to 4.3.0
- High7.2Authenticated (Administrator+) Remote Code Execution
<4.3.2Update to 4.3.2
- Low2.7Authenticated (Admin+) Directory Traversal
≤3.17.0Update to 3.17.1
- Medium4.3Missing Authorization to Resmush List Deletion
≤3.16.4Update to 3.16.5
- Medium4.4Cross-Site Scripting
≤3.9.8Update to 3.9.9
- Critical9.8Cross-Site Scripting
≤2.9.1Update to 3.0.0
- High8.8Authenticated PHAR Deserialization
≤3.0.0Update to 3.0.1
- Medium5.3Directory Traversal
≤2.7.5Update to 2.7.6
Smush – Image Optimization, Compression, Lazy Load, WebP & CDN: common questions
Does Smush – Image Optimization, Compression, Lazy Load, WebP & CDN have known vulnerabilities?
Yes. VulnCrest Radar lists 11 known vulnerabilities in Smush – Image Optimization, Compression, Lazy Load, WebP & CDN: 1 critical, 3 high, 5 medium, 2 low. None are known to affect version null.
How do I check which version of Smush – Image Optimization, Compression, Lazy Load, WebP & CDN I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent Smush – Image Optimization, Compression, Lazy Load, WebP & CDN vulnerability?
CVE-2026-118241, published Nov 11, 2026: Smush – Image Optimization, Compression, Lazy Load, WebP & CDN < 4.3.6 - Authenticated (Author+) Insecure Direct Object Reference. Severity: Medium (CVSS 4.3).
Is any Smush – Image Optimization, Compression, Lazy Load, WebP & CDN vulnerability listed in CISA KEV?
No. None of the known Smush – Image Optimization, Compression, Lazy Load, WebP & CDN vulnerabilities is currently listed in the CISA KEV catalog.