{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6626", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-25T10:26:36.435Z", "datePublished": "2025-08-02T07:24:21.083Z", "dateUpdated": "2026-04-08T16:53:43.644Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:53:43.644Z"}, "affected": [{"vendor": "shortpixel", "product": "ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.10.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization <= 3.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via API URL", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/56ab6429-4b1b-461a-9fcd-b4be84985118?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/shortpixel-adaptive-images/tags/3.10.4/includes/front/vanilla-js-loader.class.php#L48"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3337681%40shortpixel-adaptive-images&new=3337681%40shortpixel-adaptive-images&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-05-10T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-08-01T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-04T14:12:21.321297Z", "id": "CVE-2025-6626", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T14:12:57.848Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6626", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-04T14:12:21.321297Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-04T14:12:54.898Z"}}], "cna": {"title": "ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization <= 3.10.4 - Authenticated (Administrator+) Stored Cross-Site Scripting via API URL", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "shortpixel", "product": "ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.10.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-05-10T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-08-01T00:00:00.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/56ab6429-4b1b-461a-9fcd-b4be84985118?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/shortpixel-adaptive-images/tags/3.10.4/includes/front/vanilla-js-loader.class.php#L48"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3337681%40shortpixel-adaptive-images&new=3337681%40shortpixel-adaptive-images&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-08-02T07:24:21.083Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6626", "state": "PUBLISHED", "dateUpdated": "2025-08-04T14:12:57.848Z", "dateReserved": "2025-06-25T10:26:36.435Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-02T07:24:21.083Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the API URL Setting in all versions up to, and including, 3.10.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El complemento ShortPixel Adaptive Images \u2013 WebP, AVIF, CDN, Image Optimization para WordPress es vulnerable a Cross-Site Scripting almacenado a trav\u00e9s de la configuraci\u00f3n de URL de la API en todas las versiones hasta la 3.10.3 incluida, debido a una depuraci\u00f3n de entrada y un escape de salida insuficientes. Esto permite a atacantes autenticados, con acceso de administrador, inyectar scripts web arbitrarios en las p\u00e1ginas que se ejecutar\u00e1n al acceder un usuario a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2025-6626", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-08-02T08:15:26.457", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/shortpixel-adaptive-images/tags/3.10.4/includes/front/vanilla-js-loader.class.php#L48"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3337681%40shortpixel-adaptive-images&new=3337681%40shortpixel-adaptive-images&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/56ab6429-4b1b-461a-9fcd-b4be84985118?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T00:58:05.572743+00:00", "value": {"mitigation_remediation": ["Upgrade the ShortPixel Adaptive Images plugin to version 3.10.4 where the API URL input is properly sanitized and escaped.", "If the upgrade is not immediately possible, clear or disable the API URL setting in the plugin configuration to prevent script injection until a patch is applied.", "Limit the unfiltered_html capability to only trusted administrators and remove it from other accounts to enforce standard HTML filtering.", "Deploy a Web Application Firewall or implement a Content Security Policy that blocks or sanitizes user\u2011supplied scripts on rendered pages."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross\u2011Site Scripting via API URL"}, "threat_synthesis": {"affected_systems": "WordPress sites that run the ShortPixel Adaptive Images plugin version 3.10.3 or earlier on a multisite network and where the unfiltered_html capability has been disabled.\nThe 3.10.4 release is not vulnerable and includes the necessary fixes.", "description_and_impact": "The ShortPixel Adaptive Images plugin for WordPress has a flaw in the API URL setting, where input sanitization and output escaping are insufficient.\nAdministrators can inject arbitrary scripts that the plugin stores; when any visitor loads a page that uses the affected setting, the script executes, resulting in stored XSS.\nNormal users cannot inject without administrator privileges.", "risk_and_exploitability": "This vulnerability has a CVSS score of 4.4 and an EPSS score below 1\u202f%.\nIt is not listed in the CISA KEV catalog.\nAn attacker who has administrator access would need to exploit the stored XSS to deface pages, harvest credentials, or deploy additional payloads.\nBecause the flaw only exists on multisite installs with unfiltered_html disabled, the attack surface is restricted, and exploitation chance remains low."}}}}, "created": "2025-08-05T11:39:03.650682+00:00", "updated": "2026-04-22T01:00:04.370249+00:00", "vendors": ["shortpixel", "shortpixel$PRODUCT$shortpixel_adaptive_images", "wordpress", "wordpress$PRODUCT$wordpress"]}