CVE-2026-95528 in Core Web Vitals & PageSpeed Booster Plugin
Summary
by MITRE • 09/23/2026
Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/23/2026
The vulnerability identified as an unauthenticated cross-site scripting flaw within the Core Web Vitals and PageSpeed Booster plugin, specifically affecting versions up to 1.0.31, represents a significant security risk for WordPress-based websites that rely on this tool for performance optimization. This type of attack vector allows malicious actors to inject client-side scripts into web pages viewed by other users without requiring any form of authentication or prior login credentials. The presence of such a vulnerability indicates a fundamental failure in input validation and output encoding mechanisms within the plugin's codebase, where user-supplied data is processed and rendered directly into the browser environment without adequate sanitization checks.
From a technical perspective, this flaw typically arises when the application takes input from HTTP requests—such as query parameters, form submissions, or header values—and embeds it into HTML content served to the client side. In the context of performance plugins like Core Web Vitals and PageSpeed Booster, these inputs might be related to configuration settings, tracking IDs, or optimization preferences that are stored in the database and later retrieved for display on public-facing pages. If the developer fails to properly escape special characters such as angle brackets, quotes, and ampersands before rendering this data, an attacker can craft a malicious payload containing JavaScript code. When another user visits the compromised page, their browser interprets the injected script as legitimate content from the trusted domain, thereby executing it within the security context of that site.
The operational impact of this vulnerability is severe due to its unauthenticated nature and potential for widespread propagation through social engineering or search engine indexing. Attackers can exploit this flaw to steal session cookies, which may lead to account takeover if administrative credentials are stored in accessible cookies or local storage. Furthermore, the attacker can perform actions on behalf of authenticated users, such as modifying site settings, creating new administrator accounts, or defacing the website's appearance. In more sophisticated scenarios, the injected script can redirect victims to phishing sites designed to harvest sensitive information like credit card numbers or login credentials. The lack of authentication requirements means that any internet user with a basic web browser and knowledge of how to craft malicious URLs can trigger this exploit, significantly lowering the barrier for entry for less skilled threat actors.
This vulnerability aligns closely with CWE-79, which is classified as Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). The specific variant here likely falls under Reflected XSS if the payload is executed immediately from a URL parameter, or Stored XSS if the malicious script is saved in the database and served to other users later. From an offensive security framework perspective, this activity maps to MITRE ATT&CK technique T1059, specifically Command and Scripting Interpreter: JavaScript, which describes how attackers use scripting languages to execute commands on a victim's system. The unauthenticated aspect also relates to CWE-862, Missing Authorization, although the primary flaw is in input handling rather than access control logic per se.
To mitigate this vulnerability, immediate action must be taken by updating the Core Web Vitals and PageSpeed Booster plugin to version 1.0.32 or any later release where the developer has patched the input validation flaws. For organizations unable to update immediately due to compatibility concerns with other plugins or themes, a temporary workaround involves implementing strict Content Security Policy headers that restrict the execution of inline scripts and limit script sources to trusted domains only. Additionally, web application firewalls can be configured to detect and block common XSS payloads in HTTP requests before they reach the vulnerable code path. Developers should also conduct a thorough audit of all input points within the plugin's source code, ensuring that every piece of user-controlled data is properly escaped using context-aware encoding functions provided by the WordPress framework, such as esc_html or wp_kses_post, depending on where the data is being rendered. Regular security testing and penetration testing are recommended to identify similar flaws in other plugins before they can be exploited in production environments.