Squeeze – Image Optimization & Compression, WEBP Conversion

Squeeze – Image Optimization & Compression, WEBP Conversion has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2024 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 9.1 out of 10. Severity breakdown: 1 critical and 2 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Unrestricted Upload Of File With Dangerous Type, behind 3 of the records (60%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Path Traversal.

Every one of the 5 issues recorded for Squeeze – Image Optimization & Compression, WEBP Conversion has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, most of them (2) reported by astra.r3verii. Squeeze – Image Optimization & Compression, WEBP Conversion is installed on roughly 3,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
6.4/ 10
Patch Coverage100%
Open

0

Fixed

5

Get automatic notifications for all Squeeze – Image Optimization & Compression, WEBP Conversion vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.1CVE-2024-35767

Squeeze <= 1.4 - Authenticated (Admin+) Arbitrary File Upload

Read the full analysis

Vulnerability Records

5 records
Squeeze – Image Optimization & Compression, WEBP Conversion banner
Latestv1.7.15

Squeeze – Image Optimization & Compression, WEBP Conversion

Bogdan Bendziukov

Author

Bogdan Bendziukov

5.0(6)
100/100
Last Updated
2026-09-07 (5d ago)
Active Installs
3,000+
Downloads
21,167
Requires WP
6.0+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2023-06-16 (3y ago)

Unlimited image compression. No API keys. No quotas. Squeeze compresses images and converts them to WebP locally in your browser—no monthly caps, no third-party uploads. Unlike cloud-based plugins, Squeeze: ♾️ No compression limits — squeeze your entire Media Library, not just the first 100–500 images per month. ☁️ No third-party servers — images never leave your site; processing happens locally in the browser (ideal for GDPR-sensitive and membership sites). ⚡ Direct WebP conversion — convert JPG/PNG to WebP and replace the original file on disk (no duplicate copies cluttering storage). 🖼️ Optimize on upload — compress in Gutenberg, GenerateBlocks, and the Voxel theme before files hit the server (Elementor on-upload squeeze is available in Premium). The result: smaller files, faster page loads, and lower hosting storage—without SaaS fees or API keys. Squeeze official website | Plugin documentation 🌟 New in 1.7.x Direct WebP conversion: Convert JPG/PNG to WebP and replace originals—save storage without duplicate files. Pre-upload compression: Shrink images in the browser before upload (Gutenberg, GenerateBlocks, Voxel create-post and gallery fields). Three WebP delivery modes: Direct WebP, separate squeeze-webp folder with URL rewrite, or server-side delivery via .htaccess. Voxel theme support: Pre-upload squeeze on multipart AJAX uploads in create-post and file/gallery fields. WP Offload Media support: Compress CDN-hosted images (including when local files are removed), auto-detect provider/CDN URLs, and sync compressed/Direct WebP files to S3, GCS, DigitalOcean Spaces, and similar—Direct WebP recommended (sidecar WebP modes are not compatible with Offload). WordPress 7.1: While Squeeze on upload is on, core’s built-in browser image processing is turned off so Gutenberg uploads keep Squeeze quality, Direct WebP, and backups. Turn on-upload off to use WordPress HEIC conversion and HDR thumbnails. ✨ Key Features Faster pages: Smaller images improve load time, Core Web Vitals, and mobile bandwidth use. WebP conversion & serving: Convert to WebP and serve efficiently—choose Direct WebP, HTML URL rewrite, or .htaccess delivery for supported browsers. Client-side squeezing: Compress in the browser; nothing is uploaded to external optimization servers. Upload optimization: Compress on the fly during upload so optimized files land in your Media Library. Gutenberg & GenerateBlocks: Squeeze images as you add them in the block editor. Voxel theme: Compress before upload on Voxel create-post and file/gallery fields. Bulk compression: Compress hundreds of Media Library images in one run (pause/resume supported). Custom directory squeeze: Pick any folder under your site root and optimize all images inside it. Exclusions: Skip images by URL or filename pattern (one per line). Fine-tuned quality: Per-format tabs for JPEG, PNG, WebP, and AVIF (MozJPEG, OxiPNG-style PNG, and more). Backup option: Keep a .bak copy to restore the original after squeezing. Formats: JPEG, PNG, WebP, and AVIF. ⚜️ Premium Features Image comparison in the Media Library (before/after sizes). Resize originals to max width/height before squeeze. Bulk squeeze from a page — all images used on one post or page. Elementor integration — squeeze on upload while editing in Elementor. CDN URL — map CDN image URLs to local files for all WebP delivery modes. Priority support & updates Explore Premium How does Squeeze work? Open the Media Library, run Bulk Squeeze, or upload a new image — Squeeze runs Google Chrome team–backed codecs (the same family as Squoosh.app) inside your browser via Web Workers. No account, no API key, no off-site upload queue. Full documentation

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C