WordPress plugin
10Web Booster – Website speed optimization, Cache & Page Speed optimizer security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 11 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High6
- Medium3
- Low0
All 10Web Booster – Website speed optimization, Cache & Page Speed optimizer vulnerabilities
| Severity | Vulnerability | CVE | Published |
|---|---|---|---|
| High7.5 | Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path ≤2.34.5Update to 2.34.8 | CVE-2026-103896 | |
| Critical9.8 | Unauthenticated Arbitrary File Upload via 'page_id' Parameter ≤2.34.10Update to 2.34.11 | CVE-2026-108587 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting via Comment Author Name ≤2.34.8Update to 2.34.10 | CVE-2026-107742 | |
| High7.5 | Authenticated (Contributor+) PHP Object Injection ≤2.33.6Update to 2.34.0 | CVE-2026-94121 | |
| High7.2 | Unauthenticated Stored Cross-Site Scripting ≤2.33.4Update to 2.33.5 | CVE-2026-14287 | |
| Critical9.6 | Authenticated (Subscriber+) Arbitrary Folder Deletion via two_clear_page_cache ≤2.32.7Update to 2.32.11 | CVE-2025-13377 | |
| High7.2 | Missing Authorization in Settings Import to Stored Cross-Site Scripting ≤2.13.44Update to 2.13.45 | — | |
| High8.8 | Unauthenticated SQL Injection ≤2.12.22Update to 2.12.23 | — |
- High7.5Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path
≤2.34.5Update to 2.34.8
- Critical9.8Unauthenticated Arbitrary File Upload via 'page_id' Parameter
≤2.34.10Update to 2.34.11
- High7.2Unauthenticated Stored Cross-Site Scripting via Comment Author Name
≤2.34.8Update to 2.34.10
- High7.5Authenticated (Contributor+) PHP Object Injection
≤2.33.6Update to 2.34.0
- High7.2Unauthenticated Stored Cross-Site Scripting
≤2.33.4Update to 2.33.5
- Critical9.6Authenticated (Subscriber+) Arbitrary Folder Deletion via two_clear_page_cache
≤2.32.7Update to 2.32.11
- High7.2Missing Authorization in Settings Import to Stored Cross-Site Scripting
≤2.13.44Update to 2.13.45
- High8.8Unauthenticated SQL Injection
≤2.12.22Update to 2.12.23
10Web Booster – Website speed optimization, Cache & Page Speed optimizer: common questions
Does 10Web Booster – Website speed optimization, Cache & Page Speed optimizer have known vulnerabilities?
Yes. VulnCrest Radar lists 11 known vulnerabilities in 10Web Booster – Website speed optimization, Cache & Page Speed optimizer: 2 critical, 6 high, 3 medium. None are known to affect version null.
How do I check which version of 10Web Booster – Website speed optimization, Cache & Page Speed optimizer I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent 10Web Booster – Website speed optimization, Cache & Page Speed optimizer vulnerability?
CVE-2026-103896, published Oct 15, 2026: 10Web Booster <= 2.34.5 - Unauthenticated Limited File Write / Cache Poisoning via Query-string Parameter Traversal in Page-Cache Path. Severity: High (CVSS 7.5).
Is any 10Web Booster – Website speed optimization, Cache & Page Speed optimizer vulnerability listed in CISA KEV?
No. None of the known 10Web Booster – Website speed optimization, Cache & Page Speed optimizer vulnerabilities is currently listed in the CISA KEV catalog.