Vulnerabilities

TI-2026-10413 CVE-2026-12089 · GHSA-cx9x-fm2c-c65m

WS Optimize – All-in-One Speed Booster & Cache Tools <= 3.3.19 - Authenticated (Editor+) Arbitrary File Read

LOW 22

The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00336 Published 2026-06-13 No fix listed CWE-22

TI-2025-07852 CVE-2025-8575 · GHSA-6pwx-mrwj-wc74

LWS Cleaner <= 2.4.1.3 - Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file'

LOW 35

The LWS Cleaner plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'lws_cl_delete_file' function in all versions up to, and including, 2.4.1.3.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00828 Published 2025-09-12 No fix listed CWE-36

TI-2025-07452 CVE-2025-8147 · GHSA-rpmw-wf28-73qq

Improper authorization in aurelienlws LWSCache

LOW 20

The LWSCache plugin for WordPress is vulnerable to unauthorized modification of data due to improper authorization on the lwscache_activatePlugin() function in all versions up to, and including, 2.8.5.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00258 Published 2025-08-29 No fix listed CWE-285

Vulnerabilities

Filters

WS Optimize – All-in-One Speed Booster & Cache Tools <= 3.3.19 - Authenticated (Editor+) Arbitrary File Read

LWS Cleaner <= 2.4.1.3 - Authenticated (Administrator+) Arbitrary File Deletion via 'lws_cl_delete_file'

Improper authorization in aurelienlws LWSCache