CVE-2026-111737: Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists

Q: Who can exploit this issue?

A high-privilege user, such as a WordPress administrator, must be able to change the plugin settings. The issue can still be exploited where the unfiltered_html capability is disallowed, including in multisite environments.

Q: Where is the injected content rendered?

The affected DNS prefetch and font preload URL list settings are output in the head section of front-end pages. A stored payload in those settings may therefore execute when visitors load affected pages.

Q: Which versions are affected?

SiteGround Speed Optimizer versions before 7.8.5 are affected. Updating to version 7.8.5 or later addresses the affected behavior.

Published Oct 23, 2026

Updated

The Speed Optimizer WordPress plugin before 7.8.5 does not sanitise or escape some of its settings before outputting them in the head of front-end pages, which could allow high-privilege users such as admins to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in a multisite setup).

Affected Software

1 affected component

SiteGround Speed Optimizer<7.8.5

Event History

Oct 23, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A high-privilege user, such as a WordPress administrator, must be able to change the plugin settings. The issue can still be exploited where the unfiltered_html capability is disallowed, including in multisite environments.

Where is the injected content rendered?

The affected DNS prefetch and font preload URL list settings are output in the head section of front-end pages. A stored payload in those settings may therefore execute when visitors load affected pages.

Which versions are affected?

SiteGround Speed Optimizer versions before 7.8.5 are affected. Updating to version 7.8.5 or later addresses the affected behavior.

CVE-2026-111737: Speed Optimizer < 7.8.5 - Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

Where is the injected content rendered?

Which versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

Where is the injected content rendered?

Which versions are affected?