WordPress security by component
TinyPNG – JPEG, PNG & WebP image compression
Plugin description
TinyPNG – JPEG, PNG & WebP image compression is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Jul 02, 2026; the highest CVE/CNA score is 8.1.
Plugin slug:
tiny-compress-imagesLatest vulnerability
CVE-2026-7311: TinyPNG – JPEG, PNG & WebP image compression: Code execution
TinyPNG – JPEG, PNG & WebP image compression is affected by code execution. Exploitation requires at least author-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 3.6.13.
| Safe version |
|
||
|---|---|---|---|
| Jul 02, 2026 |
CVE-2026-7311
TinyPNG – JPEG, PNG & WebP image compression: Code execution
TinyPNG – JPEG, PNG & WebP image compression is affected by code execution. Exploitation requires at least author-level access. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is <= 3.6.13.
|
> 3.6.13 |
CVE8.1
NVDPending
|
| Oct 05, 2024 |
CVE-2024-47635
TinyPNG: Cross-site request forgery
TinyPNG is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.4
NVDPending
|