Core Web Vitals Pagespeed Booster Vulnerabilities

The Core Web Vitals & PageSpeed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 1.0.31. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that w...

CVSS:

7.2

(Wordfence)

Affected:

up to 1.0.31

Fixed in:

1.0.32

Disclosed:

Sep 23, 2026

CVE-2026-95528 on NVD →

The Core Web Vitals & PageSpeed Booster plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

(Wordfence)

Affected:

up to 1.0.27

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62144 on NVD →

The Core Web Vitals & PageSpeed Booster plugin for WordPress is vulnerable to Open Redirect in versions up to, and including, 1.0.12. This is due to insufficient validation on the redirect url supplied via the _wp_http_referer parameter. This makes it possible for unauthenticated attackers to redirect users to potentia...

CVSS:

4.7

(Wordfence)

Affected:

up to 1.0.12

Fixed in:

1.0.13

Disclosed:

Jun 19, 2023

CVE-2023-35883 on NVD →