Images to WebP

Images to WebP has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2021; all 2 are fixed as of September 2026. Their average CVSS score is 7.8, and the most serious one scores 8.1 out of 10. Severity breakdown: 0 critical and 2 high. 2021 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (50%). Other recurring categories include PHP Remote File Inclusion.

Every one of the 2 issues recorded for Images to WebP has a vendor fix available, so running the current release closes all known holes.

All of these findings were reported by apple502j. Images to WebP is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSHigh
7.8/ 10
Patch Coverage100%
Open

0

Fixed

2

Get automatic notifications for all Images to WebP vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.1CVE-2021-24641

Images to WebP < 1.9 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

2 records
Images to WebP banner
Latestv5.0

Images to WebP

kubiq

Author

kubiq

4.4(32)
88/100
Last Updated
2026-03-16 (6mo ago)
Active Installs
10,000+
Downloads
146,558
Requires WP
5.0+
Requires PHP
7.0+
Tested up to
WP 6.9.7
Created
2019-11-17 (7y ago)

Statistics say that WebP format can save over a half of the page weight without losing images quality. Convert PNG, JPG and GIF images to WebP and speed up your web, save visitors download data, make your Google ranking better. automated test after plugin activation to make sure it will work on your server works with all types of WordPress installations: domain, subdomain, subdirectory, multisite/network works on Apache and NGiNX image URL will be not changed so it works everywhere, in <img> src, srcset, <picture>, even in CSS backgrounds and there is no problem with cache original files will be not touched set quality of converted images auto convert on upload only convert image if WebP filesize is lower than original image filesize bulk convert existing images to WebP ( you can choose folders ) bulk convert only missing images works with `Fly Dynamic Image Resizer` plugin Hooks for developers itw_sizes Maybe you want to disable WebP for thumbnails add_filter( 'itw_sizes', 'disable_itw_sizes', 10, 2 ); function disable_itw_sizes( $sizes, $attachmentId ){ unset( $sizes['thumbnail'] ); return $sizes; } itw_htaccess Maybe you want to modify htaccess rules somehow add_filter( 'itw_htaccess', 'modify_itw_htaccess', 10, 2 ); function modify_itw_htaccess( $rewrite_rules ){ // do some magic here return $rewrite_rules; } itw_abspath Maybe you use roots.io/bedrock or other custom folder structure add_filter( 'itw_abspath', 'modify_itw_abspath', 10, 2 ); function modify_itw_abspath( $abspath ){ return trailingslashit( WP_CONTENT_DIR ); } $images_to_webp->convert_image() Maybe you want to automatically generate WebP for other plugins add_action( 'XXPLUGIN_image_created', 'XX_images_to_webp', 10, 2 ); function XX_images_to_webp( $image_path ){ global $images_to_webp; $images_to_webp->convert_image( $image_path ); }

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C