BerqWP Vulnerabilities and Affected Products - Exploit Intel

Skip to content

Products

BerqWP2 vulnerabilities
BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript2 vulnerabilities

BerqWP vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2025-58979MEDIUM	WordPress BerqWP Plugin <= 2.2.53 - Broken Access Control Vulnerability Missing Authorization vulnerability in BerqWP BerqWP searchpro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BerqWP: from n/a through <= 2.2.53. CWE-862Sep 9, 2025	CVSS5.3v3.1	EPSS0.218%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-7443HIGH	BerqWP <= 2.2.42 - Unauthenticated Arbitrary File Upload The BerqWP – Automated All-In-One Page Speed Optimization for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation via the store_javascript_cache.php file in all versions up to, and including, 2.2.42. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. CWE-434Aug 1, 2025	CVSS8.1v3.1	EPSS0.88%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-9344MEDIUM	BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript <= 2.1.1 - Reflected Cross-Site Scripting The BerqWP – Automated All-In-One PageSpeed Optimization Plugin for Core Web Vitals, Cache, CDN, Images, CSS, and JavaScript plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'url' parameter in all versions up to, and including, 2.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as… CWE-79Oct 2, 2024	CVSS6.1v3.1	EPSS0.354%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2024-43160CRITICAL	WordPress BerqWP plugin <= 1.7.6 - Unauthenticated Arbitrary File Upload vulnerability Unrestricted Upload of File with Dangerous Type vulnerability in BerqWP allows Code Injection.This issue affects BerqWP: from n/a through 1.7.6. CWE-434Aug 13, 20241 related artifact	CVSS10.0v3.1	EPSS4.62%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX