Plugin icon

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN

wp-smushit

Vulnerabilities:

5

Last Updated:

April 1, 2026

Active Installs:

1000000

Published
Title
Fixed in
CVSS
Published
2025-03-29
Title
Smush Image Compression and Optimization < 3.17.1 - Admin+ Directory Traversal
Fixed in
Fixed in 3.17.1
CVSS
2.7 (low)
Published
2024-06-20
Title
Smush < 3.16.5 - Subscriber+ Resmush List Deletion
Fixed in
Fixed in 3.16.5
CVSS
4.3 (medium)
Published
2022-05-03
Title
Smush < 3.9.9 - Admin+ Reflected Cross-Site Scripting
Fixed in
Fixed in 3.9.9
CVSS
2.6 (low)
Published
2018-12-08
Title
Smush Image Compression and Optimization < 3.0.0 - Authenticated Phar Deserialization
Fixed in
Fixed in 3.0.0
CVSS
6.0 (medium)
Published
2017-09-21
Title
Smush Image Compression and Optimization <= 2.7.5 - File Transversal
Fixed in
Fixed in 2.7.6
CVSS
7.5 (high)