CVE-2026-95528: WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.31 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The issue is described as unauthenticated XSS, so an attacker does not need an account or prior privileges. Exploitation still requires user interaction, as indicated by the UI:R vector.

Q: Which plugin versions are affected?

Core Web Vitals & PageSpeed Booster versions 1.0.31 and earlier are identified as affected.

Published Sep 23, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Core Web Vitals & PageSpeed Booster <= 1.0.31 versions.

Affected Software

1 affected component

WordPress Core Web Vitals & PageSpeed Booster<=1.0.31

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Core Web Vitals & PageSpeed Booster plugin to a version that resolves this vulnerability.
Fixed in 1.0.32

Event History

Sep 23, 2026

CVE Published

via MITRE·06:14 PM

Data Sourced

via MITRE·06:14 PM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·07:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The issue is described as unauthenticated XSS, so an attacker does not need an account or prior privileges. Exploitation still requires user interaction, as indicated by the UI:R vector.

Which plugin versions are affected?