Skip to content
Noroxi

WP Compress – Instant Performance & Speed Optimization

wp-compress-image-optimizer · plugin

Known security vulnerabilities for WP Compress – Instant Performance & Speed Optimization. Find out in seconds which version runs on your site with WP Lens.

16 known vulnerabilities

2 critical · 14 exploitable without logging in · latest Sep 3, 2026

Listed on wordpress.org · latest 7.25.00 · last updated Oct 1, 2026 · 9K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2026-73343unauthenticated→ 7.20.01

    WordPress WP Compress plugin < 7.20.01 - Remote Code Execution (RCE) vulnerability

    Critical 10.0

  • CVE-2025-47479unauthenticated≤ 6.30.30

    WordPress WP Compress plugin <= 6.30.30 - Broken Authentication Vulnerability

    Critical 9.8

  • CVE-2025-47546unauthenticated · needs a click≤ 6.30.30

    WordPress WP Compress plugin <= 6.30.30 - Cross Site Request Forgery (CSRF) Vulnerability

    High 8.8

  • CVE-2024-32106unauthenticated · needs a click≤ 6.10.35

    WordPress WP Compress plugin <= 6.10.35 - Cross Site Request Forgery (CSRF) vulnerability

    High 8.8

  • CVE-2025-2110subscriber+≤ 6.30.15

    WP Compress <= 6.30.15 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions

    High 8.8

  • CVE-2026-84757unauthenticated≤ 7.21.28

    WordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability

    High 8.2

  • CVE-2024-1934unauthenticated≤ 6.11.10

    WP Compress – Image Optimizer <= 6.11.08 - Missing Authorization to Unauthenticated CDN Modification

    High 7.5

  • CVE-2023-6699unauthenticated≤ 6.10.33

    WP Compress – Image Optimizer [All-In-One] <= 6.10.33 - Unauthenticated Directory Traversal via css

    High 7.5

  • CVE-2026-17608unauthenticated · needs a click≤ 7.10.09

    WP Compress <= 7.10.09 - Cross-Site Request Forgery to Arbitrary Options Deletion

    Medium 6.5

  • CVE-2024-12047unauthenticated · needs a click≤ 6.30.03

    WP Compress – Instant Performance & Speed Optimization <= 6.30.03 - Reflected Cross-Site Scripting via custom_server Parameter

    Medium 6.1

  • CVE-2024-47384unauthenticated · needs a click≤ 6.20.13

    WordPress WP Compress plugin <= 6.20.13 - Reflected Cross Site Scripting (XSS) vulnerability

    Medium 6.1

  • CVE-2023-6812unauthenticated · needs a click≤ 6.20.01

    WP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Open Redirect via css

    Medium 6.1

  • CVE-2025-2109unauthenticated≤ 6.30.15

    WP Compress <= 6.30.15 - Unauthenticated Server-Side Request Forgery via init Function

    Medium 5.8

  • CVE-2026-25370unauthenticated≤ 6.60.28

    WordPress WP Compress plugin <= 6.60.28 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2025-57899unauthenticated≤ 6.50.54

    WordPress WP Compress Plugin <= 6.50.54 - Broken Access Control Vulnerability

    Medium 5.3

  • CVE-2024-4445subscriber+≤ 6.20.01

    WP Compress – Image Optimizer [All-In-One] <= 6.20.01 - Missing Authorization

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory