Stored Cross-Site Scripting Vulnerability in Speed Optimizer Plugin by WordPress
CVE-2026-111737
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 October 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-111737?
The Speed Optimizer WordPress plugin prior to version 7.8.5 is susceptible to a Stored Cross-Site Scripting vulnerability due to the failure to properly sanitize or escape certain settings before rendering them in the head section of front-end pages. This flaw can potentially allow high-privilege users, such as administrators, to execute malicious scripts, even when the unfiltered_html capability is disabled, posing a significant risk, particularly in multisite environments.
Affected Version(s)
Speed Optimizer 0 < 7.8.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.