PLUGIN SECURITY
Is Image Optimization safe?
Automatically resize, optimize, and convert images to WebP and AVIF. Compress images in bulk or on upload to boost your WordPress site performance.
What this plugin does
- Slug:
image-optimization - Author: Elementor
- 1000000+ active installs
- 34/100 rating (77 reviews on wordpress.org)
- 15559132 all-time downloads
- On WordPress.org since 2024-01-08
convert AVIFconvert webpimage compressionimage optimizationperformance
Maintenance status
- Latest known version: 1.7.6
- Last updated: 2026-07-07 8:31am GMT
- Tested up to WordPress: 7.0.4
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
2 known CVEs on file for Image Optimization. Reported between 2026 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-5821 | Image Optimization – Compress Images and Convert to WebP or AVIF [image-optimization] < 1.7.5 | External Control of File Name or Path | High 8.1 | < 1.7.5 | 1.7.5 | 2026-07-01 | ✓ fixed in latest |
| CVE-2026-25387 | Image Optimization – Compress Images and Convert to WebP or AVIF [image-optimization] < 1.7.2 | Missing Authorization | Medium 4.3 | < 1.7.2 | 1.7.2 | 2026-02-19 | ✓ fixed in latest |
How to fix it
Keep Image Optimization updated — 1.7.6 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF — 1000000+ active installs — 86/100 (1653) — max PHP 8.4
- Smush – Image Optimization, Compression, Lazy Load, WebP & CDN — 1000000+ active installs — 96/100 (6050) — max PHP <8.0
- Converter for Media – Optimize images | Convert WebP & AVIF — 500000+ active installs — 98/100 (1097) — max PHP 8.4
- ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF — 300000+ active installs — 90/100 (819)
- CompressX — AVIF & WebP Converter, Media Replacement — 40000+ active installs — 100/100 (190)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.