{"id":"CVE-2026-125765","kind":"vulnerability","aliases":["CVE-2026-125765"],"related":[],"title":"ShortPixel Adaptive Images WordPress plugin: stored XSS through version 3.11.6","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ShortPixel ShortPixel Adaptive Images shortpixel-adaptive-images allows Stored XSS.This issue affects ShortPixel Adaptive Images: from n/a through 3.11.6.","summary":"ShortPixel Adaptive Images up to 3.11.6 for WordPress does not properly escape image and background-image URLs it rewrites into CDN addresses and placeholder attributes. A logged-in user with Contributor access or higher (per WPSec) can store a script that runs for anyone who opens the affected page, administrators included. WPSec lists 3.12.0 as the fix.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"shortpixel-adaptive-images","fixed":["3.12.0"],"affected":"<= 3.11.6","ecosystem":"wordpress"}],"ecosystems":[],"tags":["contributor-plus","package","self-hosted","shortpixel-adaptive-images","stored-xss","wordpress"],"not_affected_if":["no-untrusted-contributors","plugin-not-installed"],"how_to_check":"- In WordPress admin > Plugins, or run: wp plugin get shortpixel-adaptive-images --field=version\n- Versions <= 3.11.6 are affected; 3.12.0 is the fixed release per WPSec\n- If you cannot update right away, review which users have Contributor or higher roles, and check recent posts for image or background-image URLs containing quotes or angle brackets","fix":"Update ShortPixel Adaptive Images to 3.12.0 or later (per WPSec; WordPress.org shows a 3.12.0 release, but the plugin's own changelog line for this fix was not read).","status":"open","published_at":"2026-11-15T15:16:46+00:00","first_seen_at":"2026-11-15T15:36:07+00:00","triaged_at":"2026-11-15T15:37:13+00:00","updated_at":"2026-11-15T15:38:11+00:00","category":"package","confidence":0.75,"triage":{"at":"2026-11-15T15:37:13Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"ShortPixel Adaptive Images WordPress plugin: stored XSS through version 3.11.6","impact":"medium","summary":"The ShortPixel Adaptive Images WordPress plugin does not neutralize input before generating web pages, which allows stored cross-site scripting. An attacker who can get script saved into the site can run it in other visitors' browsers, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","shortpixel-adaptive-images","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker script runs in visitors' and admins' browsers","analyst_note":"Find the fixed version and the required privilege for the stored input on the NVD entry or the plugin's changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-125765.","how_to_check":"- Check whether the `shortpixel-adaptive-images` plugin is installed and its version in the WordPress admin plugins list\n- Treat any installed version up to and including `3.11.6` as affected","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the ShortPixel Adaptive Images plugin at version 3.11.6 or earlier are affected. The sources do not say which user role or input path is required to store the script, so the exposed surface is unknown. Sites that do not have the plugin installed can skip it.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00075,"input_tokens":4567,"output_tokens":586,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the required privilege for the stored input on the NVD entry or the plugin's changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-125765.","search":"'-125765':13A,16A '-2026':12A,15A '3.11.6':10A,41B,128C '3.12.0':91B 'access':69B 'adapt':2A,30B,37B,111C,115C,123C 'adaptive':19A 'address':58B 'administr':87B 'affect':85B,121C 'allow':117C 'anyon':81B 'attribut':61B 'background':51B 'background-imag':50B 'cdn':57B 'contributor':22B,68B 'contributor-plus':21B 'cross':104C 'cross-sit':103C 'cve':11A,14A 'escap':47B 'fix':94B 'generat':102C 'higher':71B 'host':27B 'imag':3A,31B,38B,48B,52B,112C,116C,124C 'images':20A 'improp':95C 'includ':88B 'input':98C 'issu':120C 'list':90B 'log':64B 'logged-in':63B 'n/a':126C 'neutral':96C 'open':83B 'packag':24B 'page':86B,101C 'per':72B 'placehold':60B 'plugin':5A 'plus':23B 'proper':46B 'rewrit':55B 'run':79B 'script':77B,106C 'self':26B 'self-host':25B 'shortpixel':1A,18A,29B,36B,109C,110C,114C,122C 'shortpixel-adaptive-imag':28B,113C 'shortpixel-adaptive-images':17A 'site':105C 'store':6A,33B,75B,118C 'stored-xss':32B 'url':53B 'user':66B 'version':9A 'vulner':107C 'web':100C 'wordpress':4A,35B,43B 'wpsec':73B,89B 'xss':7A,34B 'xss.this':119C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running ShortPixel Adaptive Images 3.11.6 or earlier. Per WPSec, an attacker needs an account with Contributor access or higher, so sites that let outsiders register or that have many authors and contributors are most exposed. Sites without the plugin, or with no untrusted logged-in users, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["shortpixeladaptiveimages"],"ptokens":["adaptive","images","shortpixel"],"labels":["contributorplus","high","package","selfhosted","shortpixeladaptiveimages","storedxss","wordpress"],"campaign_type":null,"search_a":"'-125765':13A,16A '-2026':12A,15A '3.11.6':10A 'adapt':2A 'adaptive':19A 'cve':11A,14A 'imag':3A 'images':20A 'plugin':5A 'shortpixel':1A,18A 'shortpixel-adaptive-images':17A 'store':6A 'version':9A 'wordpress':4A 'xss':7A","search_b":"'3.11.6':41B '3.12.0':91B 'access':69B 'adapt':30B,37B 'address':58B 'administr':87B 'affect':85B 'anyon':81B 'attribut':61B 'background':51B 'background-imag':50B 'cdn':57B 'contributor':22B,68B 'contributor-plus':21B 'escap':47B 'fix':94B 'higher':71B 'host':27B 'imag':31B,38B,48B,52B 'includ':88B 'list':90B 'log':64B 'logged-in':63B 'open':83B 'packag':24B 'page':86B 'per':72B 'placehold':60B 'plus':23B 'proper':46B 'rewrit':55B 'run':79B 'script':77B 'self':26B 'self-host':25B 'shortpixel':29B,36B 'shortpixel-adaptive-imag':28B 'store':33B,75B 'stored-xss':32B 'url':53B 'user':66B 'wordpress':35B,43B 'wpsec':73B,89B 'xss':34B","search_c":"'3.11.6':128C 'adapt':111C,115C,123C 'affect':121C 'allow':117C 'cross':104C 'cross-sit':103C 'generat':102C 'imag':112C,116C,124C 'improp':95C 'input':98C 'issu':120C 'n/a':126C 'neutral':96C 'page':101C 'script':106C 'shortpixel':109C,110C,114C,122C 'shortpixel-adaptive-imag':113C 'site':105C 'store':118C 'vulner':107C 'web':100C 'xss.this':119C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T15:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125765","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125765","severity":null,"published_at":"2026-11-15T15:16:46+00:00","modified_at":"2026-11-15T15:16:46+00:00","first_seen_at":"2026-11-15T15:36:07+00:00","fetched_at":"2026-11-15T15:36:07+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-125765:4051","url":"https://wpsec.com/vuln/WPSEC-2026-3103/","severity":null,"published_at":"2026-11-15T15:38:11+00:00","modified_at":"2026-11-15T15:38:11+00:00","first_seen_at":"2026-11-15T15:38:11+00:00","fetched_at":"2026-11-15T15:38:11+00:00","note":"NVD (Patchstack-assigned) gives no fix or privilege. WPSec (third-party) says Contributor+ stored XSS via image/background-image URLs, fixed in 3.12.0 (released 2026-11-12). WordPress.org SVN has a 3.12.0 tag with stable tag 3.12.0, but I did not see a changelog line tying it to this CVE. Nothing marked verified. No exploitation or PoC found; I did not search X.","cites":["https://wpsec.com/vuln/WPSEC-2026-3103/","https://plugins.svn.wordpress.org/shortpixel-adaptive-images/tags/3.12.0/readme.txt"]}],"documents":[{"id":164108,"url":"https://wpsec.com/vuln/WPSEC-2026-3103/","title":"WPSEC-2026-3103 ShortPixel Adaptive Images <= 3.11.6 Contributor+ Stored XSS","kind":"advisory","source":"analyst","publisher":null,"text":"Affected: all versions before 3.12.0. Remediation: update to 3.12.0. CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. Stored XSS via image and background image URLs; authenticated contributor-level and above. Fix released 2026-11-12.","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":164109,"url":"https://plugins.svn.wordpress.org/shortpixel-adaptive-images/tags/3.12.0/readme.txt","title":"ShortPixel Adaptive Images 3.12.0 readme (WordPress.org SVN tag)","kind":"release","source":"analyst","publisher":null,"text":"Stable tag: 3.12.0. Tested up to 7.2. Requires PHP 7.4. Readme excerpt read did not show the changelog or mention a security fix.","published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}