CVE-2026-48201

HighCVSS 7.1

Published: 30/10/2026(UTC)Updated: 30/10/2026(UTC)Translated: 30/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

14th percentile - higher than 14% of all known CVEs

Summary

The Fast Velocity Minify plugin in versions up to 3.5.7 contains an unauthenticated Cross Site Scripting (XSS) vulnerability. The description does not specify the injection vector or vulnerable parameter.

Risk Assessment

An attacker can inject a malicious script that executes in a user's browser, potentially leading to session theft or actions performed on behalf of the victim. The risk affects sites using the vulnerable plugin.

Recommendation

Upgrade the Fast Velocity Minify plugin to a version later than 3.5.7 once a fix is available. Until then, consider disabling the plugin or applying input filtering at the WAF level.

Other vulnerabilities in Fast Velocity Minify

CVE-2025-12034Medium
The Fast Velocity Minify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Original NVD description (English source)

Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS