Vulnerabilities and security researches forfast-velocity-minify fast-velocity-minify

Nov 11, 2025

CVE, Research URL: CVE-2025-12034
Home page URL: Security reports for Fast Velocity Minify
Application: Fast Velocity Minify
Date: Oct 25, 2025
Research Description: The Fast Velocity Minify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.5.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Affected versions: max 3.5.2.
Status: vulnerable

Jun 07, 2024

CVE, Research URL: CVE-2019-19983
Home page URL: Security reports for Fast Velocity Minify
Application: Fast Velocity Minify
Date: Dec 26, 2019
Research Description: In the WordPress plugin, Fast Velocity Minify before 2.7.7, the full web root path to the running WordPress application can be discovered. In order to exploit this vulnerability, FVM Debug Mode needs to be enabled and an admin-ajax request needs to call the fastvelocity_min_files action.
Affected versions: max 2.7.7.
Status: vulnerable