speed_optimizer vulnerabilities
CVEs whose affected-version data names the speed_optimizer package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111738Medium· 5.5Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option
The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed, allowing a site administrator who is no…
▾ Sunlitvia CVEORG
CVE-2026-111737Low· 3.5Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists
The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site…
▾ Sunlitvia CVEORG