SHORTPIXEL-ADAPTIVE-IMAGES · CVE-2026-125765 · Package
FIX → 3.12.0
ShortPixel Adaptive Images up to 3.11.6 for WordPress does not properly escape image and background-image URLs it rewrites into CDN addresses and placeholder attributes. A logged-in user with Contributor access or higher (per WPSec) can store a script that runs for anyone who opens the affected page, administrators included. WPSec lists 3.12.0 as the fix.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
WordPress sites running ShortPixel Adaptive Images 3.11.6 or earlier. Per WPSec, an attacker needs an account with Contributor access or higher, so sites that let outsiders register or that have many authors and contributors are most exposed. Sites without the plugin, or with no untrusted logged-in users, can skip it.
Not affected if no-untrusted-contributors, plugin-not-installed
Who cares contributor-plus, self-hosted, shortpixel-adaptive-images, stored-xss, wordpress
Upgrade to 3.12.0
Update ShortPixel Adaptive Images to 3.12.0 or later (per WPSec; WordPress.org shows a 3.12.0 release, but the plugin's own changelog line for this fix was not read).
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Stored XSS.This issue affects ShortPixel Adaptive Images: from n/a through 3.11.6.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.