Searchpro Vulnerabilities

The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.2.53. This makes it possible for unauthenticated attack...

CVSS:

5.3

Affected:

up to 2.2.53

Fixed in:

2.2.54

Disclosed:

Sep 9, 2025

CVE-2025-58979 on NVD →

[en] Missing Authorization vulnerability in BerqWP BerqWP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BerqWP: from n/a through 2.2.53.

Affected:

up to 2.2.54

Fixed in:

2.2.54

Disclosed:

Sep 9, 2025

CVE-2025-58979 on NVD →

The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it poss...

CVSS:

8.1

Affected:

up to 2.2.42

Fixed in:

2.2.44

Disclosed:

Jul 31, 2025

CVE-2025-7443 on NVD →

[en] The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output esc...

Affected:

up to 2.1.2

Fixed in:

2.1.2

Disclosed:

Oct 2, 2024

CVE-2024-9344 on NVD →

The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping...

CVSS:

6.1

Affected:

up to 2.1.1

Fixed in:

2.1.2

Disclosed:

Oct 1, 2024

CVE-2024-9344 on NVD →

[en] Unrestricted Upload of File with Dangerous Type vulnerability in BerqWP allows Code Injection.This issue affects BerqWP: from n/a through 1.7.6.

Affected:

up to 1.7.7

Fixed in:

1.7.7

Disclosed:

Aug 13, 2024

CVE-2024-43160 on NVD →

The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /api/store_webp.php file in all versions up to, and including, 1.7.6. This makes it possibl...

CVSS:

9.8

Affected:

up to 1.7.6

Fixed in:

1.7.7

Disclosed:

Aug 7, 2024

CVE-2024-43160 on NVD →

[en] Server-Side Request Forgery (SSRF) vulnerability in Berqier Ltd BerqWP.This issue affects BerqWP: from n/a through 1.7.5.

Affected:

up to 1.7.6

Fixed in:

1.7.6

Disclosed:

Jul 22, 2024

CVE-2024-37942 on NVD →

The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.7.5. This makes it possible for unauthenticated attackers to make web requests to arbitra...

CVSS:

7.2

Affected:

up to 1.7.5

Fixed in:

1.7.6

Disclosed:

Jul 10, 2024

CVE-2024-37942 on NVD →

Affected:

up to 2.2.44

Fixed in:

2.2.44

CVE-2025-7443 on NVD →