Smush – Image Optimization, Compression, Lazy Load, WebP & CDN

WordPress plugin · wp-smushit · WordPress.org ↗

Latest v4.3.3 Last release Sep 16, 2026 Tested up to WP 7.1.1 1,000,000+ active installs

Critical

High

Known total

Unfixed

Running Smush – Image Optimization, Compression, Lazy Load, WebP & CDN on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
HIGH CVSS 7.5	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 4.3.0 WPVulnerability	< 4.3.0	v4.3.0	CVE-2026-81285	Aug 27, 2026
HIGH CVSS 7.5	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 2.7.6 WPVulnerability	< 2.7.6	v2.7.6	CVE-2017-15079	Sep 21, 2017
MEDIUM CVSS 4.1	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.17.1 WPVulnerability	< 3.17.1	v3.17.1	CVE-2025-22288	Mar 29, 2025
MEDIUM CVSS 4.3	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.16.5 WPVulnerability	< 3.16.5	v3.16.5	CVE-2023-3352	Jun 20, 2024
MEDIUM CVSS 6.1	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.9.9 WPVulnerability	< 3.9.9	v3.9.9	CVE-2022-1009	May 3, 2022
UNKNOWN	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 4.3.2 WPVulnerability	< 4.3.2	v4.3.2	CVE-2026-19223	Aug 27, 2026
UNKNOWN	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.0.0 WPVulnerability	< 3.0.0	v3.0.0	—	Dec 10, 2018
UNKNOWN	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.0.1 WPVulnerability	< 3.0.1	v3.0.1	—	Dec 10, 2018
UNKNOWN	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.0.0 WPVulnerability	< 3.0.0	v3.0.0	—	Dec 10, 2018
UNKNOWN	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 2.7.6 WPVulnerability	< 2.7.6	v2.7.6	—	Oct 9, 2017
UNKNOWN	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.9.9 WPVulnerability	< 3.9.9	v3.9.9	—	—

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.