10Web Booster: RCE

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

CVE-2026-103896

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

EUVD-2026-102671

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

CVE-2026-103896 10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

CVE-2026-103896

The 10Web Booster WordPress plugin (versions up to and including 2.34.5 ) is vulnerable to unauthenticated limited file write and cache poisoning . The root cause is the OptimizerWebPageCache::get_cache_file_dir() function, which concatenates raw, unsanitized $_GET parameters into the on-disk cac...

CVE-2026-103896 10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

PT-2026-115444

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::get cache file dir function concatenating raw, unsanitized ...

CVE-2026-103896: Improper Limitation of a Pathname to a Restricted Directory

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to a limited file write via path traversal in versions up to, and including, 2.34.5 This is due to the OptimizerWebPageCache::getcachefiledir function concatenating raw, unsanitized $GE...

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning vulnerability

Unauthenticated Limited File Write / Cache Poisoning vulnerability discovered by Swayam Bhageria in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions = 2.34.5...

WordPress 10Web Booster has a path traversal vulnerability

WordPress 10Web Booster versions 2.34.5 and earlier have a path traversal vulnerability. This vulnerability arises from path traversal attacks, as the OptimizerWebPageCache::getcachefiledir function appends unclean $GET parameter names and values to the disk cache path. Additionally, the...

CVE-2026-108587

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

CVE-2026-108587

The 10Web Booster plugin for WordPress (versions up to and including 2.34.10 ) is vulnerable to unauthenticated arbitrary file upload via the compressCustom function. The root cause is a lack of file type validation and extension filtering on the page_id parameter. Attackers can bypass authentica...

EUVD-2026-101824

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

CVE-2026-108587 10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

CVE-2026-108587 10Web Booster <= 2.34.10 - Unauthenticated Arbitrary File Upload via 'page_id' Parameter

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

CVE-2026-108587: Unrestricted Upload of File with Dangerous Type

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...

PT-2026-114758

Name of the Vulnerable Software and Affected Versions 10Web Booster versions prior to 2.34.11 Description An arbitrary file upload issue exists in the compressCustom function. The flaw stems from missing file type validation and extension filtering on the page id parameter. This is combined with ...

WordPress 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin <= 2.34.10 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability discovered by Osman Hussein in WordPress Plugin 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions = 2.34.10...

CVE-2026-107742

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible...

CVE-2026-107742 10Web Booster <= 2.34.8 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible...