CVE-2026-103070: ShortPixel Image Optimizer XSS Vulnerability

CVE-2026-103070 Overview

CVE-2026-103070 is a stored cross-site scripting (XSS) vulnerability in the ShortPixel Image Optimizer WordPress plugin (shortpixel-image-optimiser). The flaw affects all plugin versions up to and including 6.5.6. An authenticated attacker with low privileges can inject malicious JavaScript that executes in the browser of any user who views the affected page. The vulnerability is tracked under CWE-79 and requires user interaction to trigger. Because the injected payload persists in the WordPress database, every subsequent visitor to the affected page becomes a potential victim.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes in administrator browsers, enabling session theft, account takeover, and arbitrary actions in the WordPress admin context.

Affected Products

ShortPixel Image Optimizer plugin for WordPress
All versions from initial release through 6.5.6
WordPress sites using shortpixel-image-optimiser

Discovery Timeline

2026-10-08 - CVE-2026-103070 published to NVD
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2026-103070

Vulnerability Analysis

The vulnerability is a stored XSS flaw in the ShortPixel Image Optimizer plugin. The plugin fails to properly neutralize user-supplied input before rendering it in generated web pages. An attacker with at least contributor-level access can submit crafted input containing JavaScript payloads. The plugin stores this input in the WordPress database without adequate sanitization or output encoding.

When another user visits a page that renders the stored content, the browser interprets the injected markup as executable script. Because the attack occurs in the context of the WordPress site, scripts run with the privileges of the viewing user. Administrators viewing affected pages face the highest risk, since successful execution can hijack their session cookies or perform privileged actions through the WordPress REST API.

The scope change in the attack path indicates the vulnerability can affect resources beyond the vulnerable component itself, consistent with XSS executing in a browser security context separate from the plugin.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The plugin accepts user-controlled data and reflects it into HTML output without applying context-appropriate escaping functions such as esc_html(), esc_attr(), or wp_kses(). WordPress provides these sanitization APIs specifically to prevent XSS, but the plugin's rendering paths bypass them for the affected input fields.

Attack Vector

Exploitation requires an authenticated session with low privileges and user interaction from a victim. An attacker submits a payload containing JavaScript through a plugin input field that lacks sanitization. The payload is persisted and later served to users loading the affected admin or front-end page. The injected script executes in the victim's browser session, granting the attacker access to cookies, tokens, and the ability to perform actions as the victim.

The vulnerability mechanism is described in the Patchstack Vulnerability Report. No public proof-of-concept exploit code has been released at the time of publication.

Detection Methods for CVE-2026-103070

Indicators of Compromise

Unexpected <script> tags, javascript: URIs, or event handlers (for example onerror=, onload=) stored in wp_posts, wp_postmeta, or plugin option tables
Administrator sessions generating outbound requests to unfamiliar domains shortly after loading plugin-managed pages
Unexpected WordPress user accounts, modified roles, or new administrator-level privileges
Browser console errors or Content Security Policy (CSP) violations on pages rendered by ShortPixel Image Optimizer

Detection Strategies

Audit the shortpixel-image-optimiser plugin version across all WordPress deployments and flag versions at or below 6.5.6
Query WordPress database tables for HTML tags, script delimiters, and encoded payloads in fields written by the plugin
Review web server access logs for POST requests to plugin endpoints followed by GET requests containing suspicious response payloads
Deploy a web application firewall (WAF) rule set that inspects stored content for common XSS payloads

Monitoring Recommendations

Enable WordPress audit logging for plugin configuration changes, user role modifications, and administrator logins
Alert on anomalous session activity for administrator accounts, particularly after they view media or plugin settings pages
Monitor browser-side telemetry and CSP reports for inline script execution on WordPress admin pages

How to Mitigate CVE-2026-103070

Immediate Actions Required

Update ShortPixel Image Optimizer to a version later than 6.5.6 as soon as the vendor publishes a patched release
Review all contributor, author, and editor accounts and revoke access for untrusted users
Rotate authentication cookies and administrator passwords if suspicious stored content is identified
Inspect plugin-managed database fields and remove any injected script payloads

Patch Information

At the time of publication, the vulnerability affects ShortPixel Image Optimizer versions up to and including 6.5.6. Consult the Patchstack Vulnerability Report and the plugin's official WordPress.org page for the latest fixed version and release notes.

Workarounds

Deactivate the shortpixel-image-optimiser plugin until a patched version is installed if the risk is unacceptable
Restrict plugin configuration access to administrator accounts only, and enforce the principle of least privilege for content contributors
Deploy a WAF with XSS signature protection in front of the WordPress site to block common injection payloads
Implement a strict Content Security Policy that disallows inline scripts and limits script sources to trusted origins

bash

# Configuration example
# Example Content-Security-Policy header for WordPress (nginx)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self';" always;