Search
Find a vulnerability
Search criteria
4 vulnerabilities found for Speed Optimizer – The All-In-One Performance-Boosting Plugin by siteground
CVE-2026-15421 (GCVE-0-2026-15421)
Vulnerability from nvd – Published: 2026-08-19 01:26 – Updated: 2026-08-20 15:36
VLAI
EPSS
VEX
Title
Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes
Summary
The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the site administrator has enabled the Lazy Load Media option in the plugin settings.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| siteground | Speed Optimizer – The All-In-One Performance-Boosting Plugin |
Affected:
0 , ≤ 7.8.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15421",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:34:35.297381Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:36:47.771Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin",
"vendor": "siteground",
"versions": [
{
"lessThanOrEqual": "7.8.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "stealthcopter"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the site administrator has enabled the Lazy Load Media option in the plugin settings."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T01:26:11.381Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2626ad96-4346-4564-b6bd-0c226bd8dfd4?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.8.0/core/Lazy_Load/Lazy_Load_Images.php#L31"
},
{
"url": "https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.8.0/core/Lazy_Load/Abstract_Lazy_Load.php#L109"
},
{
"url": "https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.8.0/core/Lazy_Load/Lazy_Load.php#L39"
},
{
"url": "https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.7.11/core/Lazy_Load/Lazy_Load_Images.php#L31"
},
{
"url": "https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.7.11/core/Lazy_Load/Abstract_Lazy_Load.php#L109"
},
{
"url": "https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.7.11/core/Lazy_Load/Lazy_Load.php#L39"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3642965%40sg-cachepress%2Ftags%2F7.8.1\u0026old=3581843%40sg-cachepress%2Ftags%2F7.8.0"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fsg-cachepress/tags/7.8.0\u0026new_path=%2Fsg-cachepress/tags/7.8.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-18T13:17:17.000Z",
"value": "Disclosed"
}
],
"title": "Speed Optimizer \u003c= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15421",
"datePublished": "2026-08-19T01:26:11.381Z",
"dateReserved": "2026-07-10T15:11:57.894Z",
"dateUpdated": "2026-08-20T15:36:47.771Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-25217 (GCVE-0-2019-25217)
Vulnerability from nvd – Published: 2024-10-16 06:43 – Updated: 2026-04-08 16:57
VLAI
EPSS
VEX
Title
SiteGround Optimizer <= 5.0.12 - Missing Authorization
Summary
The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusion in versions up to, and including, 5.0.12 due to incorrect use of an access control attribute on the switch_php function called via the /switch-php REST API route. This allows attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-16 15:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| siteground | Speed Optimizer – The All-In-One Performance-Boosting Plugin |
Affected:
0 , < 5.0.13
(semver)
|
|
| siteground | speed_optimizer |
Affected:
0 , < 5.0.13
(semver)
cpe:2.3:a:siteground:speed_optimizer:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:siteground:speed_optimizer:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "speed_optimizer",
"vendor": "siteground",
"versions": [
{
"lessThan": "5.0.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-25217",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-16T15:35:05.862279Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-16T18:05:28.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin",
"vendor": "siteground",
"versions": [
{
"lessThan": "5.0.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marc-Alexandre Montpas"
}
],
"descriptions": [
{
"lang": "en",
"value": "The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusion in versions up to, and including, 5.0.12 due to incorrect use of an access control attribute on the switch_php function called via the /switch-php REST API route. This allows attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:57:49.274Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/657f3bd7-2cdc-4eb6-ba50-7c7fca468df0?source=cve"
},
{
"url": "https://blog.sucuri.net/2019/03/vulnerability-disclosure-siteground-optimizer-caldera-forms.html"
}
],
"timeline": [
{
"lang": "en",
"time": "2019-03-14T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "SiteGround Optimizer \u003c= 5.0.12 - Missing Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2019-25217",
"datePublished": "2024-10-16T06:43:33.613Z",
"dateReserved": "2024-10-15T18:25:59.186Z",
"dateUpdated": "2026-04-08T16:57:49.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-15421 (GCVE-0-2026-15421)
Vulnerability from cvelistv5 – Published: 2026-08-19 01:26 – Updated: 2026-08-20 15:36
VLAI
EPSS
VEX
Title
Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes
Summary
The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the site administrator has enabled the Lazy Load Media option in the plugin settings.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-08-20 13:34 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
9 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| siteground | Speed Optimizer – The All-In-One Performance-Boosting Plugin |
Affected:
0 , ≤ 7.8.0
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-15421",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-08-20T13:34:35.297381Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-08-20T15:36:47.771Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin",
"vendor": "siteground",
"versions": [
{
"lessThanOrEqual": "7.8.0",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "stealthcopter"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the site administrator has enabled the Lazy Load Media option in the plugin settings."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-19T01:26:11.381Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2626ad96-4346-4564-b6bd-0c226bd8dfd4?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.8.0/core/Lazy_Load/Lazy_Load_Images.php#L31"
},
{
"url": "https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.8.0/core/Lazy_Load/Abstract_Lazy_Load.php#L109"
},
{
"url": "https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.8.0/core/Lazy_Load/Lazy_Load.php#L39"
},
{
"url": "https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.7.11/core/Lazy_Load/Lazy_Load_Images.php#L31"
},
{
"url": "https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.7.11/core/Lazy_Load/Abstract_Lazy_Load.php#L109"
},
{
"url": "https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.7.11/core/Lazy_Load/Lazy_Load.php#L39"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3642965%40sg-cachepress%2Ftags%2F7.8.1\u0026old=3581843%40sg-cachepress%2Ftags%2F7.8.0"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Fsg-cachepress/tags/7.8.0\u0026new_path=%2Fsg-cachepress/tags/7.8.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-18T13:17:17.000Z",
"value": "Disclosed"
}
],
"title": "Speed Optimizer \u003c= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-15421",
"datePublished": "2026-08-19T01:26:11.381Z",
"dateReserved": "2026-07-10T15:11:57.894Z",
"dateUpdated": "2026-08-20T15:36:47.771Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2019-25217 (GCVE-0-2019-25217)
Vulnerability from cvelistv5 – Published: 2024-10-16 06:43 – Updated: 2026-04-08 16:57
VLAI
EPSS
VEX
Title
SiteGround Optimizer <= 5.0.12 - Missing Authorization
Summary
The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusion in versions up to, and including, 5.0.12 due to incorrect use of an access control attribute on the switch_php function called via the /switch-php REST API route. This allows attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
Severity
9.8 (Critical)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2024-10-16 15:35 UTC
CWE
- CWE-862 - Missing Authorization
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| siteground | Speed Optimizer – The All-In-One Performance-Boosting Plugin |
Affected:
0 , < 5.0.13
(semver)
|
|
| siteground | speed_optimizer |
Affected:
0 , < 5.0.13
(semver)
cpe:2.3:a:siteground:speed_optimizer:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"affected": [
{
"cpes": [
"cpe:2.3:a:siteground:speed_optimizer:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unknown",
"product": "speed_optimizer",
"vendor": "siteground",
"versions": [
{
"lessThan": "5.0.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"metrics": [
{
"other": {
"content": {
"id": "CVE-2019-25217",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2024-10-16T15:35:05.862279Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2024-10-16T18:05:28.431Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Speed Optimizer \u2013 The All-In-One Performance-Boosting Plugin",
"vendor": "siteground",
"versions": [
{
"lessThan": "5.0.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Marc-Alexandre Montpas"
}
],
"descriptions": [
{
"lang": "en",
"value": "The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusion in versions up to, and including, 5.0.12 due to incorrect use of an access control attribute on the switch_php function called via the /switch-php REST API route. This allows attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:57:49.274Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/657f3bd7-2cdc-4eb6-ba50-7c7fca468df0?source=cve"
},
{
"url": "https://blog.sucuri.net/2019/03/vulnerability-disclosure-siteground-optimizer-caldera-forms.html"
}
],
"timeline": [
{
"lang": "en",
"time": "2019-03-14T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "SiteGround Optimizer \u003c= 5.0.12 - Missing Authorization"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2019-25217",
"datePublished": "2024-10-16T06:43:33.613Z",
"dateReserved": "2024-10-15T18:25:59.186Z",
"dateUpdated": "2026-04-08T16:57:49.274Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}