plugin

Google Pagespeed Insights Vulnerabilities

2 known security issues reported for the Google Pagespeed Insights WordPress plugin. Most recent disclosed Jun 27, 2022.

1 high 1 medium

Running Google Pagespeed Insights on your site? Check whether your installed version is affected.

Scan your site free

Insights from Google PageSpeed <= 4.0.6 - Multiple Cross-Site Request Forgery

high

The Insights from Google PageSpeed WordPress plugin before 4.0.7 does not verify for CSRF before doing various actions such as deleting Custom URLs, which could allow attackers to make a logged in admin perform such actions via CSRF attacks

CVSS:
8.8
Affected:
up to 4.0.6
Fixed in:
4.0.7
Disclosed:
Jun 27, 2022

CVE-2022-1672 on NVD →

Google Pagespeed Insights <= 4.0.3 - Reflected Cross-Site Scripting

medium

The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting

CVSS:
6.1
Affected:
up to 4.0.4
Fixed in:
4.0.4
Disclosed:
Mar 8, 2022

CVE-2022-0431 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database