Live › vulnerability › CVE-2026-48201
Fast Velocity Minify, a WordPress plugin that minifies assets, contains a cross-site scripting flaw reachable without logging in. An attacker can get script to run in a visitor's browser on affected sites.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC. All times on this page are UTC.
Sites running the Fast Velocity Minify WordPress plugin at version 3.5.7 or older. The sources do not describe any special configuration; the flaw is listed as unauthenticated, so a logged-out visitor can reach it.
No product ranges from the sources yet.
wp-content/plugins/fast-velocity-minify/3.5.7; versions up to and including 3.5.7 are listed as affected3.5.7 (fixed version not stated in the sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.
This page as .md · .json · in your agent: get_signal("CVE-2026-48201")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.