CVE-2026-108587

The 10Web Booster plugin for WordPress (versions up to and including 2.34.10 ) is vulnerable to unauthenticated arbitrary file upload via the compressCustom function. The root cause is a lack of file type validation and extension filtering on the page_id parameter. Attackers can bypass authentica...

EUVD-2026-101824

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. This is due to missing file type validation and extension filtering on the pageid...