The ShortPixel Image Optimizer plugin for WordPress suffers from a stored XSS vulnerability due to insufficient output escaping in the getEditorPopup() function and media-popup.php template. The attachment's post_title is retrieved from the database and directly rendered into an HTML input element's value attribute without proper escaping (esc_attr()). Since WordPress allows Authors to set arbitrary attachment titles, including characters that can break HTML attributes, an attacker with Author-level privileges can inject JavaScript that executes when an administrator or other higher-privileged user opens the ShortPixel AI editor popup for that attachment. This vulnerability affects all versions up to and including 6.4.3.

An attacker with Author-level access can inject arbitrary JavaScript into the ShortPixel AI editor popup, which executes in the context of higher-privileged users such as administrators. This can lead to session hijacking, privilege escalation, or other malicious actions within the WordPress admin interface. The vulnerability does not affect availability but impacts confidentiality and integrity.

No official patch or fix is currently confirmed or provided by the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Author-level user capabilities to trusted users only and avoid opening the ShortPixel AI editor popup for attachments created by untrusted authors. Monitor vendor channels for updates and apply patches promptly once released.