Core Web Vitals Pagespeed Booster
Monthly
Reflected cross-site scripting in Core Web Vitals & PageSpeed Booster, a WordPress performance plugin, affects versions 1.0.31 and earlier and lets an unauthenticated remote attacker get arbitrary script executed in a victim's browser session, carrying a CVSS 3.1 base score of 7.1 (High). Exploitation is not autonomous: it requires a victim (a site visitor or a logged-in administrator) to interact with an attacker-crafted request or link that reaches the vulnerable input-handling code path, so realistic abuse depends on phishing or social engineering, and the specific vulnerable parameter or page is not disclosed in the available intelligence. No public exploit code and no confirmed active exploitation are identified at time of analysis.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.0.12. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Reflected cross-site scripting in Core Web Vitals & PageSpeed Booster, a WordPress performance plugin, affects versions 1.0.31 and earlier and lets an unauthenticated remote attacker get arbitrary script executed in a victim's browser session, carrying a CVSS 3.1 base score of 7.1 (High). Exploitation is not autonomous: it requires a victim (a site visitor or a logged-in administrator) to interact with an attacker-crafted request or link that reaches the vulnerable input-handling code path, so realistic abuse depends on phishing or social engineering, and the specific vulnerable parameter or page is not disclosed in the available intelligence. No public exploit code and no confirmed active exploitation are identified at time of analysis.
URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Magazine3 Core Web Vitals & PageSpeed Booster.0.12. Rated medium severity (CVSS 4.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.