Fast Velocity Minify Vulnerabilities

[en] The Fast Velocity Minify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, t...

Affected:

up to 3.5.2

Fixed in:

3.5.2

Disclosed:

Oct 25, 2025

CVE-2025-12034 on NVD →

The Fast Velocity Minify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inj...

CVSS:

4.4

Affected:

up to 3.5.1

Fixed in:

3.5.2

Disclosed:

Oct 24, 2025

CVE-2025-12034 on NVD →

[en] In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request needs to call the fastvelocity_min_files action.

Affected:

up to 2.7.7

Fixed in:

2.7.7

Disclosed:

Dec 26, 2019

CVE-2019-19983 on NVD →

In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request needs to call the fastvelocity_min_files action.

CVSS:

4.3

Affected:

up to 2.7.6

Fixed in:

2.7.7

Disclosed:

Oct 16, 2019

CVE-2019-19983 on NVD →