The Speed Optimizer WordPress plugin fails to sanitize or escape certain configuration values before injecting them into the page head. Admin‑level users can therefore store malicious URLs in the DNS prefetch or font preload lists, and any visitor to the site will trigger execution of the injected script in their browser context. This stored XSS can be leveraged to steal session cookies, deface content, or facilitate further attacks.

All releases of the Speed Optimizer WordPress plugin prior to version 7.8.5 are affected. The vulnerability is present in the configuration interface that outputs unsanitized URL lists into the head of front‑end pages.

The risk is high because the flaw requires an attacker to have administrative access to inject the payload, but once stored the vulnerability can impact any visitor without further action. The CVSS score is 3.5 and EPSS data is unavailable, so the exact likelihood is unknown; however, stored XSS in WordPress plugins historically experiences frequent exploitation when configuration data can be controlled. The attack path involves an attacker gaining or already possessing admin rights on the target site, inserting a malicious URL into the plugin options, and then relying on users to visit the affected pages.