WP Meteor Website Speed Optimization Addon
WP Meteor Website Speed Optimization Addon has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 4 are fixed as of September 2026. Their average CVSS score is 5.0, and the most serious one scores 6.1 out of 10. 2023 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 1 of the records (25%). Other recurring categories include Cross-Site Scripting, Exposure Of Sensitive Information To An Unauthorized Actor.
Every one of the 4 issues recorded for WP Meteor Website Speed Optimization Addon has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. WP Meteor Website Speed Optimization Addon is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2026-2902WP Meteor Website Speed Optimization Addon <= 3.4.16 - Unauthenticated Stored Cross-Site Scripting via Comment
Read the full analysisVulnerability Records

WP Meteor Website Speed Optimization Addon
Author
Aleksandr Guidrevitch
WP Meteor offers an original way to further optimize your website speed. With this plugin you can increase your PageSpeed score by up to 5x. The plugin is 100% free, it is compatible and works well with most popular caching plugins like: * Autoptimize * WP Rocket * WP Total Cache * WP Super Cache * Phastpress * LiteSpeed * Hummingbird * WP Fastest Cache * SiteGround Optimizer It also works well with website builders like Elementor or with image optimizers like ShortPixel. The few known incompatibilities are listed in the FAQ. BENEFITS WP Meteor can improve your Pagespeed results and the actual loading time of your website by up to 5x! After changing performance settings, use Watchero to capture and compare pages before and after optimization. And since the plugin is designed to leave no traces on your hard drive or database when deactivated and removed, there is no risk for you. HOW IT WORKS If the user does not interact with the page immediately, WP Meteor defers loading and firing scripts until the page is rendered, which increases the pagespeed metric, on average, by 2-5x. This delay in loading scripts greatly improves perceived load times for your visitors. It also significantly improves the following important SEO metrics: Page Speed Largest Contentful Paint (LCP) Time To Interactive (TTI) Total Blocking Time (TBT) VERIFY SITE CHANGES AFTER OPTIMIZATION Performance changes, WordPress core updates, and plugin or theme updates can affect pages you do not manually check. Watchero helps capture and compare screenshots across entire sites, so agencies, freelancers, and managed hosting providers can spot visual breakages before customers do.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C