5centsCDN – WordPress CDN Plugin
5centsCDN – WordPress CDN Plugin has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 6.1, and the most serious one scores 6.1 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for 5centsCDN – WordPress CDN Plugin has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by João Pedro Soares de Alcântara. 5centsCDN – WordPress CDN Plugin is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-223265centsCDN <= 25.4.15 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
5centsCDN – WordPress CDN Plugin
Author
5centsCDN
Optimize WordPress speed and performance with 5centsCDN plugin. Get advanced caching, CDN, and seamless optimization today! Release Notes 26.06.09 (JUNE 09TH, 2026) Plugin Supports WordPress Version 7.0 Added built-in debug mode for URL rewrite tracing (define FIVECENTSCDN_DEBUG to enable) Fixed PHP 8 compatibility: array_push on null excludedPhrases Fixed PHP 8 compatibility: count() on undefined variable in zone list Fixed str_replace(“http”) mangling paths containing “http” substrings Improved error messages for better clarity and debugging Fixed issues with enabling and disabling the CDN Fixed zone list loading and display issues Fixed URL rewrite regex to match both http:// and https:// asset URLs for protocol-agnostic CDN replacement 25.4.15 (APRIL 15TH, 2025) Plugin Supports WordPress Version 6.8 24.8.16 (AUGUST 16TH, 2024) Plugin Supports WordPress Version 6.6.1 FAQs Added 24.8.12 (AUGUST 12TH, 2024) Plugin Supports WordPress Version 6.6.1 Code Improvements Improved Whole Website Acceleration 23.11.20 (NOVEMBER 20TH, 2023) Plugin Supports WordPress Version 6.4.1 Code Improvements 23.10.9 (OCTOBER 9TH, 2023) Plugin Supports WordPress Version 6.3.1 Code Improvements Improved UI/UX 23.9.1 (SEPTEMBER 1ST, 2023) Plugin Supports WordPress Version 6.3.1 Fixed Bugs that prevented Asset Acceleration to connect to CDN for some users Code Improvements 23.6.23 (JUNE 23RD, 2023) Plugin Supports WordPress Version 6.2.2 Fixed text issues in the description Improved UI/UX Code Improvements Documentation Improvements 22.11.21 (NOVEMBER 21th, 2022) Plugin Supports WordPress Version 6.1.1 Bug Fix: Asset Delivery from HTTP > HTTPS Code Improvements 22.7.27 (July 27th, 2022) Bug Fix: api call made on each page load Code Improvements 22.7.08 (July 8th, 2022) Improved Documentation Showing zone alias names 22.3.09 (March 9th, 2022) Improved UI/UX Added Asset Acceleration / Wholesite Acceleration Option to enable or disable SSL, HTTP/2 from within the plugin SSL warnings & only allow plugin to be enabled when SSL is activated in CDN Improved Purge Animations 21.6.11 (June 11th, 2021) trim trailing white spaces from the php files 21.6 (June 3rd, 2021) added register_deactivation_hook to delete the option set by the module changed 5centsCDN API version from v1 => v2 21.1 (January 29th, 2021) Change button text for saving options to ‘Save Settings’ GuzzleClient disable throwing errors on http_errors added register_uninstall_hook to delete the option set by the module 20.1 (January 8th, 2021) 5centsCDN BrandKit Update to v3 20.0 (January 22th, 2020) Initial release. Enter API key get pull zone from API Replace static links with CDN links Automatic HTTPS configuration Include or exclude specific directories or phrases Set a custom CDN hostname Show HTTP2 status and HTTP status Purge cache enabled CDN enable and disable option added
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C