Boost vulnerabilities

2 known vulnerabilities in Boost from PixelYourSite. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Boost: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-9010May 20, 2026PixelYourSite

  The Boost plugin for WordPress is vulnerable to time-based SQL Injection via the 'current_url' and 'user_name' parameters in versions up to, and including, 2.0.3 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on

• 9.8 Critical severity

  Boost: Deserialization of Untrusted Data

  CVE-2026-7637May 20, 2026PixelYourSite

  The Boost plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.0.3 via deserialization of untrusted input in the STYXKEY-BOOST_USER_LOCATION cookie. This makes it possible for unauthenticated attackers to inject a PHP