{"id":"CVE-2026-111737","title":"Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists","summary":"The Speed Optimizer  WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site…","severity":"low","cvss":3.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","cvssSource":"adp","cwe":["CWE-79"],"product":"Speed Optimizer","affected":["speed_optimizer < 7.8.5"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-23T10:39:20.398155Z"},"published":"2026-10-23","updated":"2026-10-23","sourceUpdated":"2026-10-23T10:46:04.684Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111737","references":[{"url":"https://wpscan.com/vulnerability/308b6173-139d-4940-869d-c9ff1e83c323/"}],"tags":["cve.org"],"ingestedAt":"2026-10-23T06:17:25.172Z","slug":"CVE-2026-111737","body":"## Overview\n\nThe Speed Optimizer  WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).\n\n## Affected\n\n- `speed_optimizer < 7.8.5`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":19,"depthScoreParts":{"impact":19.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":228007,"id":"CVE-2026-111737","ts":1792754645088,"field":"cvss","old":null,"new":"3.5"},{"seq":228006,"id":"CVE-2026-111737","ts":1792754645088,"field":"severity","old":"none","new":"low"}]}