Nitropack – Performance, Page Speed & Cache Plugin For Core Web Vitals, Cdn & Image Optimization
Approved changes feed: RSS · Atom
cpe:2.3:a:nitropack:nitropack_–_performance,_page_speed_&_cache_plugin_for_core_web_vitals,_cdn_&_image_optimization:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Nitropack (6ddc7233-defe-5027-83bc-02ba053dbc29) |
|---|---|
| Product | Nitropack – Performance, Page Speed & Cache Plugin For Core Web Vitals, Cdn & Image Optimization (ec8b7547-8cf3-5690-8552-9e75837b7cf6) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2025-8778 |
vulnerable | 2026-06-08 07:45:21.140553 |
NitroPack <= 1.18.4 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update via nitropack_set_compression_ajax Function
MEDIUM (4.3)
The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the nitropack_set_compression_ajax() function in all versions up to, and including, 1.18.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update the nitropack-enableCompression option and effectively change plugin compression settings.
Published: 2025-09-10T06:38:47.044Z
Updated: 2026-04-08T17:01:17.377Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11851 |
vulnerable | 2026-06-08 06:23:50.525183 |
NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Transient Update
MEDIUM (4.3)
The NitroPack plugin for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the nitropack_rml_notification function in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to integers and not arbitrary values.
Published: 2025-01-15T11:29:52.770Z
Updated: 2026-04-08T17:05:26.026Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-11848 |
vulnerable | 2026-06-08 06:23:50.519483 |
NitroPack <= 1.17.0 - Missing Authorization to Authenticated (Subscriber+) Limited Options Update
HIGH (8.1)
The NitroPack plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nitropack_dismiss_notice_forever' AJAX action in all versions up to, and including, 1.17.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options to a fixed value of '1' which can activate certain options (e.g., enable user registration) or modify certain options in a way that leads to a denial of service condition.
Published: 2025-01-15T11:24:35.912Z
Updated: 2026-04-08T16:40:44.324Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.