CVE-2026-94121

The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 2.34.10 via the compressCustom function. Missing file type validation and extension filtering on the page_id parameter, combined with a world-readable leaked nonce that bypasses authentication checks, makes it possible for unauthenticated attackers to upload files that may be executable, leading to remote code execution.

The 10Web Booster plugin for WordPress is vulnerable to arbitrary folder deletion due to insufficient file path validation in the get_cache_dir_for_page_from_url() function in all versions up to and including 2.32.7. This allows authenticated attackers with Subscriber-level access and above to delete arbitrary folders on the server, potentially leading to data loss or denial of service.

The 10Web Booster plugin for WordPress (versions up to and including 2.34.5) is vulnerable to limited file write via path traversal. An unauthenticated attacker can create arbitrary directories outside the cache root and write cached pages into them, leading to cache poisoning and arbitrary directory creation.

The 10Web Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in versions up to and including 2.34.8. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts that execute when a user accesses the page.