Stored Cross-Site Scripting Vulnerability in WPSpeed Plugin for WordPress
CVE-2026-118784

6.4MEDIUM

Key Information:

Vendor

WordPress
Status
WPspeed – WordPress Speed, Cache & Performance Optimization (core Web Vitals, Pagespeed 100)
Vendor
CVE Published:
7 November 2026

What is CVE-2026-118784?

The WPSpeed plugin for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) attack due to flaws in the LightImages HTML optimizer. These vulnerabilities arise when the system incorrectly treats certain URLs, such as the author archive, as the homepage. This misclassification allows authenticated users with low-level privileges to inject entity-encoded scripts into their profile names. When a visitor views an author archive, the injected code can execute, posing significant risks to the site's security.

Affected Version(s)

WPSpeed – WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100) 0 <= 2.6.10

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/wpspeed/tags/2...
https://plugins.trac.wordpress.org/browser/wpspeed/tags/2...

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

poiri3r
.