Speed Optimizer <= 7.8.0 Authenticated Stored XSS Vulnerability (CVE-2026-15421) Advisory

Vulnerability Overview Vulnerability Name: Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes CVE ID: CVE-2026-15421 CVSS Score: 6.4 (Medium) Publication Date: August 18, 2026 Last Update Date: August 19, 2026 Researcher: stealthcopter Impact Scope Affected Versions: Speed Optimizer <= 7.8.0 Vulnerability Type: Stored Cross-Site Scripting (Stored XSS) Attack Conditions: Authentication required (Contributor+ level) Vulnerability Description: The Speed Optimizer plugin, in versions 7.8.0 and earlier, contains a stored cross-site scripting vulnerability due to insufficient input validation and output escaping. This allows authenticated attackers (with Contributor level or higher privileges) to inject arbitrary scripts into pages, which are executed when users visit the affected pages. This vulnerability is exploitable only when the "Lazy Load Media" option is enabled in the plugin settings. Remediation Fixed Version: Upgrade to 7.8.1 or later Patch Status: Fixed Additional Information Reference Links: - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org - plugins.trac.wordpress.org Related Vulnerabilities Speed Optimizer <= 7.4.6 - Missing Authorization via purge_on_other_events() - CVE ID: CVE-2024-32532 - CVSS Score: 5.3 - Researcher: Rafe Muhammad - Publication Date: April 15, 2024 SiteGround Optimizer <= 5.0.12 - Missing Authorization - CVE ID: CVE-2019-25217 - CVSS Score: 9.8 - Researcher: Marc-Alexandre Montpas - Publication Date: March 14, 2019 Summary The Speed Optimizer plugin, in versions 7.8.0 and earlier, contains a stored cross-site scripting vulnerability that requires authentication (Contributor+ level) for exploitation. It is recommended to upgrade to version 7.8.1 or later to mitigate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

Speed Optimizer <= 7.8.0 Authenticated Stored XSS Vulnerability (CVE-2026-15421) Advisory

More from this source