# Converter for Media – Optimize images | Convert WebP & AVIF

> Speed up your website by using our WebP & AVIF Converter. Optimize images and serve WebP and AVIF images instead of standard formats!

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-06 04:27 UTC.

## Facts (WordPress.org)

- Slug: `webp-converter-for-media`
- Author: Mateusz Gbiorczyk
- Version: 6.7.2
- Active installs: 500,000+
- Last update: 2026-11-05 (1 day ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 4.9, PHP 7.4
- Tags: compress images, convert webp, image optimization, optimize images, webp
- Page: https://wordpress.org/plugins/webp-converter-for-media/

## Checks (against WordPress 7.1.4)

- OK: Updated 1 day ago.
- OK: Tested with WordPress 7.1.
- OK: Runs on any PHP WordPress supports (PHP 7.4+).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Slows pages ↔ Speeds up, Clashes ↔ Plays well, Inaccessible ↔ Accessible, Flaky ↔ Reliable, Breaking ↔ Smooth, Behind ↔ Current.

## Known vulnerabilities

- 2026-02-11 MEDIUM: Unauthenticated Server-Side Request Forgery via src (up to 6.5.1). CVE-2026-1356, https://www.wordfence.com/threat-intel/vulnerabilities/id/188d812c-2955-4b0c-ae1c-b42c0f60b73b?source=api-prod
- 2025-12-16 MEDIUM: Missing Authorization to Authenticated (Subscriber+) Optimized Image Deletion via regenerate-attachment REST Endpoint (up to 6.3.2). CVE-2025-13750, https://www.wordfence.com/threat-intel/vulnerabilities/id/9a31190f-e2ed-46ee-a224-85a0a003738d?source=api-prod
- 2021-12-27 MEDIUM: Unauthenticated Open Redirect (before 4.0.3). CVE-2021-25074, https://www.wordfence.com/threat-intel/vulnerabilities/id/16919724-e495-492e-8cc7-639e6d8473c2?source=api-prod
- 2019-06-27 HIGH: Cross-Site Request Forgery (up to 1.0.2). CVE-2019-15834, https://www.wordfence.com/threat-intel/vulnerabilities/id/5cbb8495-70e0-48cc-84d9-6d3cf3ec5355?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=webp-converter-for-media · HTML: https://todaywp.com/plugins/webp-converter-for-media