PLUGIN SECURITY
Is Webp Converter For Media safe?
Speed up your website by using our WebP & AVIF Converter. Optimize images and serve WebP and AVIF images instead of standard formats!
What this plugin does
- Slug:
webp-converter-for-media - Author: Mateusz Gbiorczyk
- 500000+ active installs
- 98/100 rating (1098 reviews on wordpress.org)
- 16999733 all-time downloads
- On WordPress.org since 2019-06-16
compress imagesconvert webpimage optimizationoptimize imageswebp
Maintenance status
- Latest known version: 6.6.4
- Last updated: 2026-08-18 10:21pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
4 known CVEs on file for Webp Converter For Media.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-13750 | Converter for Media – Optimize images | Convert WebP & AVIF [webp-converter-for-media] < 6.4.0 | Missing Authorization | Medium 4.3 | < 6.4.0 | 6.4.0 | 2025-12-16 | ✓ fixed in latest |
| CVE-2019-15834 | Converter for Media – Optimize images | Convert WebP & AVIF [webp-converter-for-media] < 1.0.3 | Cross-Site Request Forgery (CSRF) | High 8.8 | < 1.0.3 | 1.0.3 | 2019-06-27 | ✓ fixed in latest |
| — | Converter for Media – Optimize images | Convert WebP & AVIF [webp-converter-for-media] < 1.0.3 | — | Unknown | < 1.0.3 | 1.0.3 | 2019-06-27 | ✓ fixed in latest |
| — | Converter for Media – Optimize images | Convert WebP & AVIF [webp-converter-for-media] < 6.5.2 | — | Unknown | < 6.5.2 | 6.5.2 | 0000-00-00 | ✓ fixed in latest |
| CVE-2021-25074 | WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect | — | Unknown | < 4.0.3 | 4.0.3 | — | ✓ fixed in latest |
| CVE-2026-1356 | Converter for Media – Optimize images < 6.5.2 - Unauthenticated SSRF | — | Unknown | < 6.5.2 | 6.5.2 | — | ✓ fixed in latest |
How to fix it
Keep Webp Converter For Media updated — 6.6.4 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Smush – Image Optimization, Compression, Lazy Load, WebP & CDN — 1000000+ active installs — 96/100 (6051) — max PHP <8.0
- Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF — 1000000+ active installs — 86/100 (1653) — max PHP 8.4
- Image Optimization – Compress Images and Convert to WebP or AVIF — 1000000+ active installs — 34/100 (77) — max PHP 8.4
- ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF — 300000+ active installs — 90/100 (819)
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization — 200000+ active installs — 94/100 (638)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.