Is Wp Smushit safe?

Plugin details

• Slug: wp-smushit
• Requires PHP: 7.4+
• Max supported PHP (analyzed): 8.4

Known vulnerabilities

• CVE-2017-15079 — Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 2.7.6 (Path Traversal) · High
• CVE-2022-1009 — Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.9.9 (XSS) · Medium
• Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.0.0
• Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 2.7.6
• Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.0.1

+ 4 more known vulnerabilities

• Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.0.0
• Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.9.9
• CVE-2023-3352 — Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.16.5 (Missing Authorization) · Medium
• CVE-2025-22288 — Smush – Image Optimization, Compression, Lazy Load, WebP & CDN [wp-smushit] < 3.17.1 (CWE-35) · Medium

Vulnerabilities are matched against the exact installed version when it's known. Always keep the plugin updated to the latest release.

Safer / more established alternatives

• Imagify Image Optimization: Optimize Images | Compress & Convert to WebP/AVIF — 1000000+ active installs — max PHP 8.4
• Image Optimization – Compress Images and Convert to WebP or AVIF — 1000000+ active installs — max PHP 8.4
• Converter for Media – Optimize images | Convert WebP & AVIF — 500000+ active installs — max PHP 8.4
• ShortPixel Image Optimizer – Optimize Images, Convert WebP & AVIF — 300000+ active installs
• Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization — 200000+ active installs