Skip to content
Sign in
3.5 Low

CVE-2026-111737 The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting…

Description

The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Affected products and versions

Product Affected versions Fixed in
Speed Optimizer 7.8 earliest → < 7.8.5 7.8.5

Other CVEs of Speed Optimizer

The 3 CVEs of Speed Optimizer →
CVE-2026-111738 The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option… 5.5 Medium CVE-2026-3220 The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress… 8.8 High
Track this CVE