Boost
Boost has 2 disclosed vulnerabilities in the WordSec catalog, all reported in 2026; all 2 are fixed as of August 2026. Their average CVSS score is 8.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 1 high. 2026 was the busiest year with 2 disclosures.
The most common weakness is Deserialization Of Untrusted Data, behind 1 of the records (50%). Other recurring categories include SQL Injection.
Every one of the 2 issues recorded for Boost has a vendor fix available, so running the current release closes all known holes.
All of these findings were reported by Osvaldo Noe Gonzalez Del Rio (Os).
Highest severity on recordCVSS 9.8
CVE-2026-7637Boost <= 2.0.3 - Unauthenticated PHP Object Injection via STYXKEY-BOOST_USER_LOCATION Cookie
Read the full analysisVulnerability Records
2 records
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C