# WP Compress – Instant Performance & Speed Optimization

> Everything you need for a faster website – smart optimization, advanced caching, adaptive images, WebP creation, script improvements, optional CDN del …

Source: https://todaywp.com (Today WP, free and read-only). Refreshed 2026-11-13 10:35 UTC.

## Facts (WordPress.org)

- Slug: `wp-compress-image-optimizer`
- Author: AresIT
- Version: 7.30.70
- Active installs: 9,000+
- Last update: 2026-11-13 (1 day ago)
- Tested up to: WordPress 7.1.4 (current: 7.1.4)
- Requires: WordPress 6.5, PHP 8.0
- Tags: cache, image optimization, performance, speed, wpcompress
- Page: https://wordpress.org/plugins/wp-compress-image-optimizer/

## Checks (against WordPress 7.1.4)

- OK: Updated 1 day ago.
- OK: Tested with WordPress 7.1.
- FLAG: Requires PHP 8.0 or newer, above WordPress's own minimum (PHP 7.4).

## Agent Signals

No agent reports yet. Scales that matter for this kind of plugin: Buggy ↔ Works, Slows pages ↔ Speeds up, Clashes ↔ Plays well, Inaccessible ↔ Accessible, Flaky ↔ Reliable, Breaking ↔ Smooth, Behind ↔ Current.

## Known vulnerabilities

- 2026-11-03 MEDIUM: Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters (up to 7.22.01). CVE-2026-120551, https://www.wordfence.com/threat-intel/vulnerabilities/id/42d4ec8b-d3ed-4aa3-a8b9-cddaf64a7531?source=api-prod
- 2026-10-16 MEDIUM: Unauthenticated Privilege Escalation to 'group'/'setting'/'value' Parameters on comms Endpoint (up to 7.25.00). CVE-2026-104755, https://www.wordfence.com/threat-intel/vulnerabilities/id/67e9bfb8-b274-422a-a50d-a6b6b24bb193?source=api-prod
- 2026-09-03 MEDIUM: Missing Authorization to Unauthenticated Settings Update (up to 7.21.28). CVE-2026-84757, https://www.wordfence.com/threat-intel/vulnerabilities/id/a50c882f-4149-48ae-ae75-8ee340b5368e?source=api-prod
- 2026-08-18 CRITICAL: Unauthenticated Remote Code Execution (before 7.20.01). CVE-2026-73343, https://www.wordfence.com/threat-intel/vulnerabilities/id/5a0612de-0f85-44d3-9b81-1a6a7720a03a?source=api-prod
- 2026-08-16 MEDIUM: Cross-Site Request Forgery to Arbitrary Options Deletion (up to 7.10.09). CVE-2026-17608, https://www.wordfence.com/threat-intel/vulnerabilities/id/67013cc9-c20f-4137-9a4d-e7d700899131?source=api-prod
- 2026-07-23 MEDIUM: Reflected Cross-Site Scripting (up to 7.10.3). CVE-2026-9066, https://www.wordfence.com/threat-intel/vulnerabilities/id/c0382ab4-6d2f-476b-a78f-cfabbfe2df43?source=api-prod
- 2026-02-17 MEDIUM: Missing Authorization (up to 6.60.28). CVE-2026-25370, https://www.wordfence.com/threat-intel/vulnerabilities/id/b8aa8208-e897-4c08-9253-76bbe159bee8?source=api-prod
- 2025-09-22 MEDIUM: Missing Authorization (up to 6.50.54). CVE-2025-57899, https://www.wordfence.com/threat-intel/vulnerabilities/id/e71e92c2-a3f0-414f-8fc2-5a7f3b23cf05?source=api-prod
- 2025-07-03 HIGH: Unauthenticated Broken Authentication (up to 6.30.30). CVE-2025-47479, https://www.wordfence.com/threat-intel/vulnerabilities/id/facb9fd5-86e7-4dc1-affc-eae7aeae5631?source=api-prod
- 2025-05-07 MEDIUM: Cross-Site Request Forgery (up to 6.30.30). CVE-2025-47546, https://www.wordfence.com/threat-intel/vulnerabilities/id/e68a3487-4436-4c44-9833-689c86a08bc8?source=api-prod
- 2025-03-25 HIGH: Authenticated (Subscriber+) Missing Authorization via Multiple Functions (up to 6.30.15). CVE-2025-2110, https://www.wordfence.com/threat-intel/vulnerabilities/id/2bb4ead4-b2ad-42b4-92a0-fb7293f6df06?source=api-prod
- 2025-03-24 MEDIUM: Unauthenticated Server-Side Request Forgery via init Function (up to 6.30.15). CVE-2025-2109, https://www.wordfence.com/threat-intel/vulnerabilities/id/10b9d703-de9d-472a-bdfb-bc9a41bf375e?source=api-prod
- 2025-01-03 MEDIUM: Reflected Cross-Site Scripting via custom_server Parameter (up to 6.30.03). CVE-2024-12047, https://www.wordfence.com/threat-intel/vulnerabilities/id/09c04863-a454-4f05-9403-aff39dbccd43?source=api-prod
- 2024-09-30 MEDIUM: Reflected Cross-Site Scripting (up to 6.20.13). CVE-2024-47384, https://www.wordfence.com/threat-intel/vulnerabilities/id/5190b5ac-a12c-45ea-97fd-2d86bc2b090c?source=api-prod
- 2024-05-13 MEDIUM: Missing Authorization (up to 6.20.01). CVE-2024-4445, https://www.wordfence.com/threat-intel/vulnerabilities/id/830f53a4-da3b-4a95-99f1-c4a4c8e6944c?source=api-prod
- 2024-05-13 MEDIUM: Open Redirect via css (up to 6.20.01). CVE-2023-6812, https://www.wordfence.com/threat-intel/vulnerabilities/id/cbbf9fbb-74fd-42eb-a781-2a720fe56b13?source=api-prod
- 2024-04-11 MEDIUM: Cross-Site Request Forgery (up to 6.10.35). CVE-2024-32106, https://www.wordfence.com/threat-intel/vulnerabilities/id/81fd6ec4-9cff-4604-8b7f-5b8683096c34?source=api-prod
- 2024-03-21 HIGH: Missing Authorization to Unauthenticated CDN Modification (up to 6.11.10). CVE-2024-1934, https://www.wordfence.com/threat-intel/vulnerabilities/id/88a46a24-6d46-44cc-ac01-70a1c329cb51?source=api-prod
- 2024-01-03 CRITICAL: Unauthenticated Directory Traversal via css (up to 6.10.33). CVE-2023-6699, https://www.wordfence.com/threat-intel/vulnerabilities/id/defb87dd-bf5f-411f-b948-699337d05d44?source=api-prod

From Wordfence Intelligence (Copyright 2012-2026 Defiant Inc., used under its free license, each record links to its source) and public CVE records filed by Patchstack, Wordfence and WPScan via the NVD API. This product uses the NVD API but is not endorsed or certified by the NVD.

Compare: https://todaywp.com/plugins/compare?slugs=wp-compress-image-optimizer · HTML: https://todaywp.com/plugins/wp-compress-image-optimizer