Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-compress-image-optimizer
WP Compress
18 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 16, 2026WP Compress – Instant Performance & Speed Optimization: Privilege EscalationCVE-2026-104755 · affects up to 7.25.00 · reported by WordfenceMedium 4.8
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 7.25.00 The vulnerability exists because the `start_comms` dispatcher (`wps_ic_comms::start_comms`), hooked on every front-end request, gates access only by comparing the caller-supplied `apikey` parameter against the stored plugin API key with no WordPress capability check and no nonce verification, then passes the unvalidated `group`, `setting`, and `value` parameters directly to `change_setting()`, which writes them into the `WPS_IC_SETTINGS` option without an allow-list. This makes it possible for unauthenticated attackers to write arbitrary permission keys into the plugin's settings, causing `wps_ic_users::checkAndAddCaps()` to grant any WordPress role — including Subscriber — the `manage_wpc_settings` capability and thereby achieve plugin-administrator-equivalent control over the plugin's optimization, CDN, and critical-CSS surfaces. The API key required to pass the authorization check can itself be obtained without authentication via the `wpc_send_critical_remote` nopriv AJAX action: when the external critical-CSS service
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Sep 3, 2026Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.CVE-2026-84757 · affects up to 7.21.28 · reported by PatchstackHigh 8.2
Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.
Aug 18, 2026Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.CVE-2026-73343 · reported by PatchstackCritical 10
Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.
Aug 16, 2026WP Compress – Instant Performance & Speed Optimization: Cross-Site Request ForgeryCVE-2026-17608 · affects up to 7.10.09 · reported by WordfenceMedium 6.5
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.10.09. This is due to missing or incorrect nonce validation on the (top-level template code) function. This makes it possible for unauthenticated attackers to delete arbitrary WordPress options, including critical ones such as siteurl, home, active_plugins, template, and stylesheet, causing site outage or a full plugin and theme reset via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jul 23, 2026WP Compress: Does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the pageCVE-2026-9066 · fixed in 7.10.04 · reported by WPScanMedium 6.1
The WP Compress WordPress plugin before 7.10.04 does not validate the value of a query parameter that controls the asset CDN host before using it to build the URLs of JavaScript files emitted on the page, leading to Reflected XSS. When a visitor follows a crafted link, the WP Compress WordPress plugin before 7.10.04's loader injects script elements pointing to an attacker-controlled origin, which lets the attacker execute arbitrary JavaScript in the visitor's session on the target site.
Feb 19, 2026WP Compress: Missing AuthorizationCVE-2026-25370 · affects up to 6.60.28 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Compress: from n/a through <= 6.60.28.
Sep 22, 2025WP Compress: Missing AuthorizationCVE-2025-57899 · affects up to 6.50.54 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Compress: from n/a through <= 6.50.54.
Jul 4, 2025WP Compress: Weak AuthenticationCVE-2025-47479 · affects up to 6.30.30 · reported by PatchstackMedium 5.3
Weak Authentication vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Authentication Abuse.This issue affects WP Compress: from n/a through <= 6.30.30.
May 7, 2025WP Compress: Cross-Site Request Forgery (CSRF)CVE-2025-47546 · affects up to 6.30.30 · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Cross Site Request Forgery.This issue affects WP Compress: from n/a through <= 6.30.30.
Mar 26, 2025WP Compress – Instant Performance & Speed Optimization: Unauthorized access, modification, and loss of dataCVE-2025-2110 · affects up to 6.30.15 · reported by WordfenceHigh 8.8
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to missing capability checks on its on its AJAX functions in all versions up to, and including, 6.30.15. This makes it possible for authenticated attackers, with Subscriber-level access and above, to compromise the site in various ways depending on the specific function exploited - for example, by retrieving sensitive settings and configuration details, or by altering and deleting them, thereby disclosing sensitive information, disrupting the plugin’s functionality, and potentially impacting overall site performance.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Mar 25, 2025WP Compress – Instant Performance & Speed Optimization: Server-Side Request ForgeryCVE-2025-2109 · affects up to 6.30.15 · reported by WordfenceMedium 5.8
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.30.15 via the init() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query information from internal services.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 4, 2025WP Compress – Instant Performance & Speed Optimization: Reflected Cross-Site ScriptingCVE-2024-12047 · affects up to 6.30.03 · reported by WordfenceMedium 6.1
The WP Compress – Instant Performance & Speed Optimization plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘custom_server’ parameter in all versions up to, and including, 6.30.03 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 5, 2024WP Compress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-47384 · affects up to 6.20.13 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AresIT WP Compress wp-compress-image-optimizer allows Reflected XSS.This issue affects WP Compress: from n/a through <= 6.20.13.
May 14, 2024WP Compress – Image Optimizer [All-In-One]: Unauthorized modification of dataCVE-2024-4445 · affects up to 6.20.01 · reported by WordfenceMedium 6.5
The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the several functions in versions up to, and including, 6.20.01. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to edit plugin settings, including storing cross-site scripting, in multisite environments.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
May 14, 2024WP Compress – Image Optimizer [All-In-One: Open RedirectCVE-2023-6812 · affects up to 6.20.01 · reported by WordfenceMedium 4.3
The WP Compress – Image Optimizer [All-In-One plugin for WordPress is vulnerable to Open Redirect in all versions up to, and including, 6.20.01. This is due to insufficient validation on the redirect url supplied via the 'css' parameter. This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action.
Apr 11, 2024WP Compress – Image Optimizer [All-In-One]: Cross-Site Request Forgery (CSRF)CVE-2024-32106 · affects up to 6.10.35 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in WP Compress WP Compress – Image Optimizer [All-In-One].This issue affects WP Compress – Image Optimizer [All-In-One]: from n/a through 6.10.35.
Apr 9, 2024WP Compress – Image Optimizer: Unauthorized modification of dataCVE-2024-1934 · affects up to 6.11.10 · reported by WordfenceHigh 7.5
The WP Compress – Image Optimizer plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'wps_local_compress::__construct' function in all versions up to, and including, 6.11.10. This makes it possible for unauthenticated attackers to reset the CDN region and set a malicious URL to deliver images.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 11, 2024WP Compress – Image Optimizer [All-In-One]: Directory TraversalCVE-2023-6699 · affects up to 6.10.33 · reported by WordfenceCritical 9.1
The WP Compress – Image Optimizer [All-In-One] plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 6.10.33 via the css parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive information.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.