CVE-2026-111737
CVE-2026-111737 · Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
CVSS 3.5 · Faible · EPSS 0,2% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
speed optimizer
- Versions du logiciel
- ≥ 0, < 7.8.5: Concernée (semver)
Mettez à jour vers 7.8.5