Published October 24, 2026. Based on public CVE records available on that date; details may change.

Two CVEs published on October 23, 2026 affect Speed Optimizer, SiteGround's caching and performance plugin (WordPress.org slug sg-cachepress), in all versions before 7.8.5. Both need an administrator account to exploit and matter most on WordPress multisite networks. Update Speed Optimizer to 7.8.5, which is the current version on WordPress.org, and review who holds administrator access on each site.

What happened

Both issues were reported by researcher Karthik Ramakrishnan and coordinated through WPScan, which assigned the CVEs. Speed Optimizer has 1,000,000+ active installations on WordPress.org as of October 24, 2026. The 7.8.5 changelog, dated October 20, 2026, lists "Security improvements" and "Multisite support improvements" and thanks Karthik Ramakrishnan for responsibly disclosing two security issues.

CVE-2026-111737 (titled "Admin+ Stored XSS via DNS Prefetch and Font Preload URL Lists"): the record says the plugin does not sanitize or escape some of its settings before printing them in the head of front-end pages. An administrator could save a value that runs JavaScript in visitors' browsers, even when the unfiltered_html capability is turned off. That capability is normally withheld from site administrators on multisite networks, which is why this matters there.

CVE-2026-111738 (titled "Admin+ Network Option Update via enable-option/disable-option"): the record says the plugin does not check for network-level privilege before applying an option change to the whole multisite network, and does not restrict which option may be changed. A site administrator who is not a Super Admin could create or overwrite network-wide options.

In plain terms, both issues let a site-level administrator step outside the limits WordPress multisite is designed to enforce. On a single-site install, an administrator can already add scripts and change options, so the practical gain for an attacker is smaller.

Severity and exploitation status

The WPScan-issued CVE records do not include their own CVSS score. CISA's ADP (Authorized Data Publisher) entries in the records score them as follows:

  • CVE-2026-111737: CVSS 3.1 base score 3.5 (low), requiring high privileges and user interaction.
  • CVE-2026-111738: CVSS 3.1 base score 5.5 (medium), requiring high privileges and no user interaction, with high integrity impact.

The records do not report exploitation. CISA's assessment in both records lists exploitation as "none" and marks the issues as not automatable. NVD lists both CVEs with the status "Deferred," meaning NVD has not added its own analysis. The WPScan references in the records are tagged as including exploit details, so assume technical information is or will be public.

Who is affected

Any site running Speed Optimizer older than 7.8.5 has the vulnerable code. Exposure is highest when:

  • The site is part of a WordPress multisite network where individual site administrators are not Super Admins. This is common for agencies, schools, and companies that give each department or client its own site.
  • More people hold administrator accounts than strictly need them.
  • An administrator account has a weak, reused, or leaked password, or no two-factor authentication.

For a single-site install with one or two trusted administrators, the risk from these two CVEs is low. The main concern there is that a stolen admin login could use CVE-2026-111737 to plant script that survives in the plugin's settings rather than in theme or plugin files.

How to check your site

Start by confirming the installed version.

  1. In the WordPress admin, open Plugins and find Speed Optimizer. On a multisite network, open Network Admin > Plugins. Note the version number.
  2. With WP-CLI, run wp plugin list --name=sg-cachepress from the WordPress directory to see the status and version.
  3. Run wp plugin get sg-cachepress --field=version if you only want the version number.
  4. Repeat for staging and development copies, which often lag behind production.

If the version is lower than 7.8.5, the site is affected.

Next, check who can reach the vulnerable settings. Run wp user list --role=administrator --fields=ID,user_login,user_email,user_registered to list administrators. On multisite, add --url= with each site's address, and run wp super-admin list to see network-level admins. Anyone you do not recognize is worth investigating.

Then look at the settings named in CVE-2026-111737. In the Speed Optimizer settings, review the DNS prefetch and font preload URL lists. They should contain only plain URLs your team added. Anything that looks like HTML, quotes, or script is a red flag. You can also view the source of a front-end page and check the head section for script your team did not add.

What to do now

The fix is to update Speed Optimizer to 7.8.5. Use Dashboard > Updates, the Plugins screen (or Network Admin > Plugins on multisite), or wp plugin update sg-cachepress. The changelog lists other changes in the same release, including caching and multisite improvements, so check the front end and admin after updating and purge the cache.

If you cannot update right away, reduce exposure until you can:

  • Remove administrator access from accounts that do not need it, and downgrade them to Editor or a lower role.
  • Require strong, unique passwords and two-factor authentication for every administrator.
  • On multisite, review which site administrators exist on each subsite and confirm each one is expected.

After the update, update the plugin on every environment, not only production. If you found unexpected values in the DNS prefetch or font preload lists, or admin accounts nobody recognizes, treat the site as possibly compromised. Our guide to finding hidden WordPress admin users covers the account checks, and how to fix a hacked WordPress site covers cleanup. Limiting administrator roles is also part of the WordPress hardening checklist.

When to get help

Get help if you find script in the plugin's settings, administrators nobody recognizes, or network-wide settings that changed without a reason. WordPress malware removal is the right starting point for a suspected compromise, and a security audit can review roles and plugin settings across a multisite network.

Sources