Skip to content
OpenAdvisories

Vendor

tinypng

2 known vulnerabilities.

Products

TinyPNG 1 TinyPNG – JPEG, PNG & WebP image compression 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.1
    CVE-2026-7311

    TinyPNG <= 3.6.13 - Authenticated (Author+) Arbitrary File Deletion via 'convert.path' in 'tiny_compress_images' Post Meta

    The TinyPNG – JPEG, PNG & WebP image compression plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the delete_converted_image_size function in all versions up to, and including, 3.6.13. This makes it pos…

    tinypng TinyPNG – JPEG, PNG & WebP image compression Web / CMS