CVE-2026-57342
MediumCVSS 6.5Summary
The ShortPixel Adaptive Images plugin version 3.11.3 and earlier contains a Cross Site Scripting (XSS) vulnerability exploitable by subscribers. This allows a subscriber-level user to inject malicious JavaScript code into the page.
Risk Assessment
An attacker with subscriber role can steal administrator sessions, redirect users to malicious sites, or alter website content, leading to security breaches and reputational damage for the organization.
Recommendation
Immediately update the ShortPixel Adaptive Images plugin to version 3.11.4 or later, which fixes this vulnerability. Additionally, restrict subscriber permissions to the minimum necessary.
Other vulnerabilities in ShortPixel Adaptive Images
See all- CVE-2026-56066Medium
The ShortPixel Adaptive Images plugin versions up to 3.11.4 contain a vulnerability allowing an unauthenticated attacker to delete arbitrary files on the server. The flaw is due to missing proper authorization and input validation.
- CVE-2026-15345Medium
The ShortPixel Adaptive Images plugin for WordPress up to version 3.11.5 is vulnerable to authorization bypass. Improper verification of user permissions allows authenticated attackers with subscriber-level access and above to modify configuration options of third-party plugins such as ShortPixel Image Optimizer, Autoptimize, WP Rocket, Imagify, and LiteSpeed Cache, as well as the plugin's own API key and account binding.
Original NVD description (English source)
Subscriber Cross Site Scripting (XSS) in ShortPixel Adaptive Images <= 3.11.3 versions.