CVE-2022-0431: Google Pagespeed Insights < 4.0.4 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-04 · updated 2026-06-17
Weakness: CWE-79

Description

The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting

Affected products

Insights from Google PageSpeed: before 4.0.4 — fixed in 4.0.4

How to fix

Upgrade to a fixed version: Insights from Google PageSpeed 4.0.4. Check the vendor advisory for mitigations.

References

https://plugins.trac.wordpress.org/changeset/2690415
https://wpscan.com/vulnerability/52bd94df-8816-48fd-8788-38d045eb57ca
https://plugins.trac.wordpress.org/changeset/2690415
https://wpscan.com/vulnerability/52bd94df-8816-48fd-8788-38d045eb57ca

Get alerted when CVE-2022-0431 or the next vulnerability affects your stack