Vulnerabilities and security researches forwp-smushit wp-smushit

Apr 02, 2025

CVE, Research URL: CVE-2025-22288
Home page URL: Security reports for Smush – Optimize, Compress and Lazy Load Images
Application: Smush – Optimize, Compress and Lazy Load Images
Date: -
Research Description: Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP & AVIF | Image CDN [wp-smushit] < 3.17.1 CVE-2025-22288
Affected versions: Min -, max -.
Status: vulnerable

Jun 22, 2024

CVE, Research URL: CVE-2023-3352
Home page URL: Security reports for Smush – Optimize, Compress and Lazy Load Images
Application: Smush – Optimize, Compress and Lazy Load Images
Date: Jun 21, 2024
Research Description: The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library.
Affected versions: Min -, max -.
Status: vulnerable

Jun 07, 2024

CVE, Research URL: CVE-2017-15079
Home page URL: Security reports for Smush – Optimize, Compress and Lazy Load Images
Application: Smush – Optimize, Compress and Lazy Load Images
Date: Oct 06, 2017
Research Description: The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2022-1009
Home page URL: Security reports for Smush – Optimize, Compress and Lazy Load Images
Application: Smush – Optimize, Compress and Lazy Load Images
Date: May 30, 2022
Research Description: The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file
Affected versions: Min -, max -.
Status: vulnerable