The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization WordPress plugin versions up to 3.10.3 contain a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the API URL Setting. Authenticated users with administrator privileges can inject arbitrary web scripts that persist and execute in the context of users visiting the injected pages. This vulnerability specifically impacts multi-site WordPress installations or those where the unfiltered_html capability is disabled, increasing the risk of script injection and potential session hijacking or other script-based attacks. The CVSS 3.1 base score is 4.4, reflecting a medium severity with network attack vector, high attack complexity, and requiring high privileges but no user interaction.

An authenticated administrator on affected WordPress multi-site installations or sites with disabled unfiltered_html can inject persistent malicious scripts via the API URL Setting. These scripts execute in the context of users visiting the compromised pages, potentially leading to information disclosure or session hijacking. The impact is limited by the requirement for administrator-level access and specific site configurations. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and consider enabling unfiltered_html capability if feasible. Monitor for plugin updates from ShortPixel and apply them promptly once available to address this vulnerability.