CVE-2026-95528: Core Web Vitals & PageSpeed Booster XSS Flaw

CVE-2026-95528 Overview

CVE-2026-95528 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Core Web Vitals & PageSpeed Booster, affecting versions up to and including 1.0.31. The flaw allows a remote attacker to inject arbitrary JavaScript into pages served by a vulnerable site without authentication. Successful exploitation requires user interaction, such as clicking a crafted link or visiting a poisoned page. The scope is changed, meaning injected script can affect resources beyond the vulnerable component, including the browsing user's session context. The issue is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in a victim's browser, enabling session theft, credential harvesting, and administrative account compromise on WordPress sites running the vulnerable plugin.

Affected Products

Core Web Vitals & PageSpeed Booster WordPress plugin, versions <= 1.0.31
WordPress sites with the plugin active and reachable from the internet
Any WordPress installation that has not upgraded past 1.0.31

Discovery Timeline

2026-09-23 - CVE-2026-95528 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-95528

Vulnerability Analysis

The vulnerability is a reflected or stored Cross-Site Scripting flaw in the Core Web Vitals & PageSpeed Booster WordPress plugin. The plugin fails to properly sanitize or encode user-supplied input before rendering it in HTML output. An unauthenticated attacker can craft a payload that, when processed by the plugin, causes the browser to execute attacker-controlled JavaScript.

Because the CVSS scope is changed, the injected script executes in the context of the WordPress site and can access resources beyond the vulnerable plugin, including administrative interfaces and authenticated sessions. Exploitation requires that a user interact with the malicious content, typically by visiting a crafted URL.

Refer to the Patchstack XSS Vulnerability Report for the underlying advisory.

Root Cause

The root cause is missing or insufficient output encoding of user-controllable input handled by the plugin. Data flows from an untrusted source into an HTML sink without contextual escaping, satisfying the conditions for CWE-79.

Attack Vector

The attack vector is network-based and requires no privileges. An attacker delivers a crafted URL or payload to a target user through phishing, social media, or a compromised third-party site. When the victim loads the malicious content in the context of the vulnerable WordPress site, the payload executes in the victim's browser. If the victim holds administrative privileges, the attacker can pivot to full site takeover by creating accounts, modifying content, or planting persistent backdoors.

No verified public exploit code is currently referenced in the CVE record. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2026-95528

Indicators of Compromise

Unexpected <script> tags, event handlers, or javascript: URIs stored in plugin-managed database fields or rendered pages
WordPress access logs containing requests with encoded HTML or JavaScript payloads targeting plugin endpoints
New or modified administrator accounts created shortly after suspicious page loads
Outbound browser requests from administrator sessions to unfamiliar external domains

Detection Strategies

Inventory WordPress installations and identify sites running Core Web Vitals & PageSpeed Booster at version <= 1.0.31
Inspect HTTP request and response bodies for XSS payload patterns such as <script, onerror=, onload=, and encoded variants
Review the plugin's stored configuration and rendered output for unexpected script content
Correlate anomalous administrator activity with prior page visits containing crafted parameters

Monitoring Recommendations

Enable web application firewall rulesets that flag XSS payloads directed at WordPress plugin endpoints
Forward WordPress and reverse proxy logs to a centralized analytics platform for query and alerting
Alert on creation of privileged WordPress users and changes to plugin or theme files
Monitor for browser-side security policy violations reported through Content Security Policy (CSP) reporting endpoints

How to Mitigate CVE-2026-95528

Immediate Actions Required

Update the Core Web Vitals & PageSpeed Booster plugin to a version later than 1.0.31 as soon as a fixed release is available
Deactivate and remove the plugin on affected sites if a patched version is not yet published
Rotate WordPress administrator credentials and invalidate active sessions on sites that may have been targeted
Review recent administrator activity and audit user accounts for unauthorized additions or role changes

Patch Information

Refer to the Patchstack advisory for the latest fixed version and vendor guidance. Apply plugin updates through the WordPress admin dashboard or via WP-CLI once a patched release is confirmed.

Workarounds

Deploy a web application firewall with signatures for reflected and stored XSS targeting WordPress plugins
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins
Restrict administrative access to the WordPress dashboard by IP allowlisting or VPN
Require multi-factor authentication for all WordPress administrator accounts to limit the impact of session hijacking

bash

# Configuration example: update or remove the vulnerable plugin using WP-CLI
wp plugin update core-web-vitals-pagespeed-booster
wp plugin deactivate core-web-vitals-pagespeed-booster
wp plugin delete core-web-vitals-pagespeed-booster