Core Web Vitals Pagespeed Booster Vulnerabilities

The Core Web Vitals & PageSpeed Booster plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 1.0.27. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 1.0.27

Fix:

No patched version reported

Disclosed:

Dec 31, 2025

CVE-2025-62144 on NVD →

The Core Web Vitals & PageSpeed Booster plugin for WordPress is vulnerable to Open Redirect in versions up to, and including, 1.0.12. This is due to insufficient validation on the redirect url supplied via the _wp_http_referer parameter. This makes it possible for unauthenticated attackers to redirect users to potentia...

CVSS:

4.7

Affected:

up to 1.0.12

Fixed in:

1.0.13

Disclosed:

Jun 19, 2023

CVE-2023-35883 on NVD →