Live › vulnerability › CVE-2026-111737
Go to dashboardThe Speed Optimizer WordPress plugin before 7.8.5 outputs some of its settings into the page head without sanitising or escaping them. A high-privilege user such as an admin can store script that runs in visitors' browsers, even where unfiltered_html is disabled, as in a multisite setup.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running the Speed Optimizer WordPress plugin before 7.8.5, especially multisite networks where administrators lack the unfiltered_html capability. Exploitation needs an account with high privileges, so sites with few trusted admins carry less risk. Sites not running this plugin can skip it.
No product ranges from the sources yet.
wp plugin get speed-optimizer --field=version (plugin slug assumed; unknown if the sources give it)7.8.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in a multisite setup).
This page as .md · .json · in your agent: get_signal("CVE-2026-111737")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.