WordPress security by component
Speed Optimizer
Plugin description
Speed Optimizer provides caching and performance optimization features for WordPress websites.
Speed Optimizer (sg-cachepress) is a WordPress plugin with 2 published CVE records in this archive. The latest tracked vulnerability was published Aug 19, 2026; the highest published CVSS base score is 6.4.
Plugin slug:
sg-cachepressLatest vulnerability
CVE-2026-15421: Speed Optimizer lazy-load image attributes permit Contributor stored XSS
Speed Optimizer through 7.8.0 insufficiently sanitizes and escapes image tag attributes when the administrator has enabled Lazy Load Media. A Contributor can place script-capable content in those attributes; the payload is stored in a page and executes whenever a visitor opens the injected page.
| Safe version |
|
||
|---|---|---|---|
| Aug 19, 2026 |
CVE-2026-15421
Speed Optimizer lazy-load image attributes permit Contributor stored XSS
Speed Optimizer through 7.8.0 insufficiently sanitizes and escapes image tag attributes when the administrator has enabled Lazy Load Media. A Contributor can place script-capable content in those attributes; the payload is stored in a page and executes whenever a visitor opens the injected page.
|
See mitigation notes |
CVE6.4
|
| Apr 17, 2024 |
CVE-2024-32532
Speed Optimizer: A security weakness
Speed Optimizer is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
|