ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization Security & Risk Analysis

The shortpixel-adaptive-images plugin v3.11.1 presents a mixed security posture. While it demonstrates good practices in SQL query handling and avoids bundled libraries, significant concerns arise from its attack surface and output escaping. The plugin exposes a large number of AJAX handlers (15 total) with a concerning 14 of them lacking proper authorization checks, creating a substantial entry point for unauthenticated attackers. Furthermore, only 9% of its extensive output is properly escaped, indicating a high risk of Cross-Site Scripting (XSS) vulnerabilities, especially when combined with the unprotected AJAX endpoints. The taint analysis confirms this, revealing 3 high-severity flows, potentially exploitable through these unauthenticated routes. Despite having no currently unpatched CVEs, the plugin's history of 8 medium-severity vulnerabilities, including XSS, SSRF, CSRF, and authorization/access control issues, suggests a recurring pattern of security weaknesses. This history, coupled with the present code analysis findings, indicates that while the plugin authors are addressing past issues, fundamental security practices around input validation, authorization, and output escaping need significant improvement to mitigate current and future risks.