Speed Optimizer The All In One Performance Boosting Plugin
Monthly
Stored Cross-Site Scripting in the SiteGround Speed Optimizer WordPress plugin (all versions through 7.8.0) allows authenticated contributors to inject persistent malicious JavaScript via unsanitized image tag attributes, executing in any visitor's browser upon page load. Exploitation is gated on the Lazy Load Media option being enabled in plugin settings, limiting but not eliminating real-world exposure across the large SiteGround-hosted WordPress ecosystem. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a patched release (7.8.1) is confirmed available via the WordPress plugin repository.
Stored Cross-Site Scripting in the SiteGround Speed Optimizer WordPress plugin (all versions through 7.8.0) allows authenticated contributors to inject persistent malicious JavaScript via unsanitized image tag attributes, executing in any visitor's browser upon page load. Exploitation is gated on the Lazy Load Media option being enabled in plugin settings, limiting but not eliminating real-world exposure across the large SiteGround-hosted WordPress ecosystem. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a patched release (7.8.1) is confirmed available via the WordPress plugin repository.