Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · wp-smushit
Smush
7 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 16, 2026Smush: Does not restrict changes to a network-wide access setting to network administratorsCVE-2026-110039 · fixed in 4.3.4 · reported by WPScanLow 2.7
The Smush WordPress plugin before 4.3.4 does not restrict changes to a network-wide access setting to network administrators, allowing an administrator of a single site on a multisite network to change it for the entire network.
Aug 28, 2026Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.CVE-2026-81285 · affects up to 4.2.0 · reported by PatchstackHigh 7.5
Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.
Aug 27, 2026Smush: Does not restrict a network-wide setting to network administratorsCVE-2026-19223 · fixed in 4.3.2 · reported by WPScanHigh 7.2
The Smush WordPress plugin before 4.3.2 does not restrict a network-wide setting to network administrators, allowing an administrator of any single site on a multisite network to execute arbitrary code across the entire network.
Nov 6, 2025Smush Image Compression and Optimization: Path Traversal: '.../...//'CVE-2025-22288 · affects up to 3.17.0 · reported by PatchstackMedium 4.1
Path Traversal: '.../...//' vulnerability in WPMU DEV - Your All-in-One WordPress Platform Smush Image Compression and Optimization wp-smushit allows Path Traversal.This issue affects Smush Image Compression and Optimization: from n/a through <= 3.17.0.
Jun 20, 2024Smush: Unauthorized deletion of the resmush listCVE-2023-3352 · reported by WordfenceMedium 4.3
The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library.
May 30, 2022Smush: Does not sanitise and escape a configuration parameter before outputting it back in an admin pageCVE-2022-1009 · fixed in 3.9.9 · reported by WPScanMedium 6.1
The Smush WordPress plugin before 3.9.9 does not sanitise and escape a configuration parameter before outputting it back in an admin page when uploading a malicious preset configuration, leading to a Reflected Cross-Site Scripting. For the attack to be successful, an attacker would need an admin to upload a malicious configuration file
Oct 6, 2017The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.CVE-2017-15079 · fixed in 2.7.6 · reported by MITREHigh 7.5
The Smush Image Compression and Optimization plugin before 2.7.6 for WordPress allows directory traversal.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.