PT-2026-121765
CVE-2026-111737
·
Published
2026-10-23
·
Updated
2026-10-23
Description by
CVSS 3.1
3.5
LowMetricsAV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered html capability is disallowed (for example in a multisite setup).
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾