CVE-2026-14287: TenWeb Speed Optimizer < 2.33.5 - Unauthenticated Stored XSS via Critical CSS Token Bypass
The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors to an affected page.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Sites running the 10Web Booster WordPress plugin with a version earlier than 2.33.5 are affected. The vulnerable handler is unauthenticated, so exposure does not depend on an attacker having a WordPress account.
What does an attacker need to exploit this?
An attacker needs to send a request to the plugin's unauthenticated handler and bypass its access-token validation. They can then store attacker-controlled stylesheet content that is rendered into a page head without escaping.
Who may be impacted by successful exploitation?
Anonymous visitors whose browsers load an affected page may execute the stored attacker-supplied JavaScript. The issue is stored XSS, so the payload can affect visitors after the attacker has submitted it.