¿Es seguro Wp Smushit?

Qué hace este plugin

• Slug: wp-smushit
• 1000000+ instalaciones activas

compress imagesconvert webpimage optimizationimage optimizeroptimize images

Estado de mantenimiento

• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

4 CVEs conocidos registrados para Wp Smushit. Reportadas entre 2017 y 2025.

CVE-2025-22288

The Smush Image Optimization – Optimize Images | Compress & Lazy Load Images | Convert WebP & AVIF | Image CDN plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.17.0. This makes it possible for authenticated attackers, with Administrator-level access and above, to perform actions on files outside of the originally intended directory.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-3352

The Smush plugin for WordPress is vulnerable to unauthorized deletion of the resmush list due to a missing capability check on the delete_resmush_list() function. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to delete the resmush list for Nextgen or the Media Library.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-1009

The Smush – Lazy Load Images, Optimize & Compress Images plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'name' and 'description' parameters in versions up to, and including, 3.9.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. This requires an attacker to trick an administrator into uploading a malicious configuration file in order to be successful.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.0.0

Authenticated XSS & Phar Deserialization vulnerabilities found by RIPS Technologies in WordPress Smush Image Compression and Optimization plugin (versions <= 2.9.1).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.0.1

The Smush – Lazy Load Images, Optimize & Compress Images plugin for WordPress is vulnerable to deserialization of untrusted input via the '$log_file' value in versions up to, and including 3.0.0. This makes it possible for authenticated attackers to call files using a PHAR wrapper that will deserialize the data and call arbitrary PHP Objects that can be used to perform a variety of malicious actions granted a POP chain is also present. It also requires that the attacker is successful in uploading a file with the serialized payload.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.0.0

The Smush – Lazy Load Images, Optimize & Compress Images plugin for WordPress is vulnerable to Cross-Site Scripting leading in versions up to, and including, 2.9.1 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject malicious web scripts into the application.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 2.7.6

File Traversal vulnerability found by Ricardo Sánchez in WordPress Smush Image Compression and Optimization plugin (versions <=2.7.5).

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2017-15079

The Smush – Lazy Load Images, Optimize & Compress Images WordPress plugin was affected by a File Transversal security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

+ 1 vulnerabilidad conocida más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.9.9	—	Desconocido	< 3.9.9	3.9.9	—	—

Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.9.9

The Smush – Lazy Load Images, Optimize & Compress Images WordPress plugin was affected by an Authenticated Phar Deserialization security vulnerability.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Actualiza este plugin a la última versión de wordpress.org — cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en") cuando hay una registrada.

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF — 1000000+ instalaciones activas — 86/100 (1650) — PHP máx. 8.4
• Image Optimization – Compress Images and Convert to WebP or AVIF — 1000000+ instalaciones activas — 34/100 (77) — PHP máx. 8.4
• Converter for Media – Optimize images | Convert WebP & AVIF — 500000+ instalaciones activas — 98/100 (1091) — PHP máx. 8.4
• ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF — 300000+ instalaciones activas — 90/100 (816)
• Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization — 200000+ instalaciones activas — 94/100 (635)