PageSpeed Booster EUVD-2026-85496

Exploitation requires that a victim (site visitor or logged-in administrator) interact with an attacker-crafted request or link that reaches the vulnerable input-handling code path in Core Web Vitals & PageSpeed Booster plugin versions 1.0.31 or earlier on a WordPress site; no authentication is required of the attacker (PR:N). The primary limiting factor is the mandatory user interaction (UI:R) - the payload does not execute autonomously - meaning realistic abuse relies on social engineering/phishing to trigger the reflected script. The specific vulnerable parameter or page is not disclosed in the available data.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L = 7.1 HIGH) describes an unauthenticated, network-reachable reflected/DOM XSS requiring victim interaction, with a scope change (S:C) reflecting script execution crossing from the vulnerable plugin into the visitor's browser session. Real-world risk is moderate rather than urgent: the A:L (availability) and I:L impacts are generous for a classic XSS - realistic impact is confined to client-side session/DOM manipulation, so a defensible re-score lands closer to ~6.1 with A:N. No EPSS score, no CISA KEV listing, and no public POC were provided, so exploitation is theoretical at this time and there is no evidence of automation or in-the-wild use. The UI:R requirement (a victim must click a crafted link or load a malicious request) is the primary limiting factor and pushes this toward opportunistic/targeted phishing-style abuse rather than mass exploitation. This is a legitimate patch-management item, not a drop-everything emergency; SSVC-style triage would likely land at 'track' given no exploitation, low automatability, and partial technical impact.

An attacker crafts a URL or form request targeting a vulnerable parameter in the Core Web Vitals & PageSpeed Booster plugin (<=1.0.31) and delivers it to a site visitor or administrator via phishing or a malicious link. When the victim's browser loads the reflected input, attacker-controlled JavaScript executes in the context of the WordPress site, enabling session/cookie theft, defacement, or admin-action forgery. No public proof-of-concept was identified at time of analysis, and the attack requires the victim to interact with the malicious request.