WP Meteor Website Speed Optimization Addon <= 3.4.16 - Unauthenticated Stored Cross-Site Scripting via Comment
medium
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'frontend_rewrite' function's 'WPMETEOR[N]WPMETEOR' placeholder content in all versions up to, and including, 3.4.16 due to insufficient input sanitization and output escaping. This makes it possible...
- CVSS:
- 6.1
- Affected:
- up to 3.4.16
- Fixed in:
- 3.4.17
- Disclosed:
- Apr 28, 2026
CVE-2026-2902 on NVD →
WP Meteor Website Speed Optimization Addon [wp-meteor] < 3.4.4
unknown
[en] The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.3.This is due to the plugin utilizing wpdesk and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full p...
- Affected:
- up to 3.4.4
- Fixed in:
- 3.4.4
- Disclosed:
- Jul 24, 2024
CVE-2024-6553 on NVD →
WP Meteor Website Speed Optimization Addon <= 3.4.3 - Unauthenticated Full Path Disclosure
medium
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 3.4.3.This is due to the plugin utilizing wpdesk and leaving test files with display_errors on. This makes it possible for unauthenticated attackers to retrieve the full path o...
- CVSS:
- 5.3
- Affected:
- up to 3.4.3
- Fixed in:
- 3.4.4
- Disclosed:
- Jul 23, 2024
CVE-2024-6553 on NVD →
WP Meteor Website Speed Optimization Addon [wp-meteor] < 3.1.5
unknown
[en] Cross-Site Request Forgery (CSRF) vulnerability in Aleksandr Guidrevitch WP Meteor Website Speed Optimization Addon plugin <= 3.1.4 versions.
- Affected:
- up to 3.1.5
- Fixed in:
- 3.1.5
- Disclosed:
- Nov 13, 2023
CVE-2023-26543 on NVD →
WP Meteor Page Speed Optimization Topping <= 3.1.4 -Missing Authorization to Notice Dismissal
medium
The WP Meteor Page Speed Optimization Topping plugin for WordPress is vulnerable to unauthorized admin notice dismissal due to a missing capability check on the processAjaxNoticeDismiss function in versions up to, and including, 3.1.4. This makes it possible for authenticated attackers with subscriber level access to d...
- CVSS:
- 4.3
- Affected:
- up to 3.1.4
- Fixed in:
- 3.1.5
- Disclosed:
- Mar 3, 2023
WP Meteor Website Speed Optimization Addon [wp-meteor] < 3.1.5
unknown
The WP Meteor Page Speed Optimization Topping plugin for WordPress is vulnerable to unauthorized admin notice dismissal due to a missing capability check on the processAjaxNoticeDismiss function in versions up to, and including, 3.1.4. This makes it possible for authenticated attackers with subscriber level access to d...
- Affected:
- up to 3.1.5
- Fixed in:
- 3.1.5
- Disclosed:
- Mar 3, 2023
WP Meteor Page Speed Optimization Topping <= 3.1.4 - Cross-Site Request Forgery via processAjaxNoticeDismiss
medium
The WP Meteor Page Speed Optimization Topping plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.4. This is due to missing or incorrect nonce validation on the processAjaxNoticeDismiss function. This makes it possible for unauthenticated attackers to dismiss admin not...
- CVSS:
- 4.3
- Affected:
- up to 3.1.4
- Fixed in:
- 3.1.5
- Disclosed:
- Feb 28, 2023
CVE-2023-26543 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database