WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization

Boost site speed and performance with an all-in-one cache and speed optimization plugin. Pass Core Web Vitals with CDN, image optimization, lazy loadi …

7Reported vulnerabilities
8.1Highest CVSS score
1.19.9Latest version
90,000+Active installs

What to do now

Update NitroPack – Performance, Page Speed & Cache Plugin for Core Web Vitals, CDN & Image Optimization to 1.19.4 or later. 7 of these have a fixed version available. Updating resolves them.

Plugin last updated: July 22, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2024-11848 High 8.1 0.7% 0 to 1.17.0 (inclusive) 1.17.6 January 15, 2025
CVE-2024-43922 High 7.3 0.4% 1.16.7 and earlier 1.16.8 August 26, 2024
WF-fb6f4b0b-25b8-4dcd-b002-293ce8ab307e Medium 6.3 — Before 1.10.0 1.10.0 November 7, 2023
CVE-2026-39669 Medium 5.3 0.2% 1.19.3 and earlier 1.19.4 February 18, 2026
CVE-2025-8778 Medium 4.3 0.2% 0 to 1.18.4 (inclusive) 1.18.5 September 10, 2025
CVE-2024-11851 Medium 4.3 0.3% 0 to 1.17.0 (inclusive) 1.17.6 January 15, 2025
CVE-2023-52121 Medium 4.3 0.2% 1.10.2 and earlier 1.10.3 December 28, 2023

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.