CVE-2026-111737

LowCVSS 3.5

Published: 23/10/2026(UTC)Updated: 23/10/2026(UTC)Translated: 23/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

4th percentile - higher than 4% of all known CVEs

Summary

The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages. This could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Risk Assessment

A privileged user can inject a persistent script that executes for all site visitors. This may lead to session hijacking of administrators and other users.

Recommendation

Update the Speed Optimizer plugin to version 7.8.5 or later. Review plugin settings for unexpected values.

Other vulnerabilities in Speed Optimizer WordPress plugin

CVE-2026-111738Medium
The Speed Optimizer WordPress plugin before 7.8.5 does not verify network-level privilege before applying an option change to the whole multisite network, nor restrict which option may be changed. This allows a site administrator who is not a Super Admin to create or overwrite network-wide options.

Original NVD description (English source)

The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).

Vulnerability data from NVD (NIST) · CISA KEV · EPSS