Smush – Image Optimization, Compression, Lazy Load, WebP & CDN

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN has 9 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; all 9 are fixed as of October 2026. Their average CVSS score is 5.9, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 3 high. 2026 was the busiest year with 3 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (22%). Other recurring categories include Path Traversal, Code Injection.

Every one of the 9 issues recorded for Smush – Image Optimization, Compression, Lazy Load, WebP & CDN has a vendor fix available, so running the current release closes all known holes.

7 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

5.9/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Smush – Image Optimization, Compression, Lazy Load, WebP & CDN vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8

Smush – Lazy Load Images, Optimize & Compress Images <= 2.9.1 - Cross-Site Scripting

Read the full analysis

Vulnerability Records

9 records


2026-10-14 00:00	Smush <= 4.3.3 - Missing Authorization Smush <= 4.3.3	`CVE-2026-110039`	2.7 Low	Erwan LR	Yes
2026-08-27 00:00	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN < 4.3.2 - Authenticated (Administrator+) Remote Code Execution Smush < 4.3.2	`CVE-2026-19223`	7.2 High	Jakub Herman	Yes
2026-08-27 00:00	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN <= 4.2.0 - Unauthenticated Denial of Service Smush <= 4.2.0	`CVE-2026-81285`	7.5 High	Asim Alshaya	Yes
2025-03-29 00:00	Smush Image Compression and Optimization <= 3.17.0 - Authenticated (Admin+) Directory Traversal Smush <= 3.17.0	`CVE-2025-22288`	2.7 Low	SteveSec	Yes
2024-06-20 00:00	Smush – Lazy Load Images, Optimize & Compress Images <= 3.16.4 - Missing Authorization to Resmush List Deletion Smush <= 3.16.4	`CVE-2023-3352`	4.3 Medium	Truoc Phan	Yes
2022-05-03 00:00	Smush – Lazy Load Images, Optimize & Compress Images <= 3.9.8 - Cross-Site Scripting Smush <= 3.9.8	`CVE-2022-1009`	4.4 Medium	Taurus Omar	Yes
2018-12-10 00:00	Smush – Lazy Load Images, Optimize & Compress Images <= 3.0.0 - Authenticated PHAR Deserialization Smush <= 3.0.0	`N/A`	8.8 High	Anonymous	Yes
2018-12-10 00:00	Smush – Lazy Load Images, Optimize & Compress Images <= 2.9.1 - Cross-Site Scripting Smush <= 2.9.1	`N/A`	9.8 Critical	Anonymous	Yes
2017-09-21 00:00	Smush – Lazy Load Images, Optimize & Compress Images <= 2.7.5 - Directory Traversal Smush <= 2.7.5	`CVE-2017-15079`	5.3 Medium	Ricardo Sanchez	Yes

Showing 1–9 of 9 reports