Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?AutoptimizeRapidLoad Power-Up for Autoptimize
Plugin · unusedcss
RapidLoad Power-Up for Autoptimize
20 known vulnerabilities on record. Add your version above to see which ones affect you.
Mar 27, 2025RapidLoad: Missing AuthorizationCVE-2025-22665 · affects up to 2.4.4 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Shakeeb Sadikeen RapidLoad unusedcss allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RapidLoad: from n/a through <= 2.4.4.
Jan 31, 2025RapidLoad – Optimize Web Vitals Automatically: Unauthorized modification of dataCVE-2024-13651 · affects up to 2.4.4 · reported by WordfenceMedium 4.3
The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_deactivate() function in all versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to reset some of the plugin's settings.
Dec 11, 2024RapidLoad – Optimize Web Vitals Automatically: Unauthorized access of data and modification of dataCVE-2024-11840 · affects up to 2.4.2 · reported by WordfenceHigh 7.1
The RapidLoad – Optimize Web Vitals Automatically plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the uucss_data, update_rapidload_settings, wp_ajax_update_htaccess_file, uucss_update_rule, upload_rules, get_all_rules, update_titan_settings, preload_page, and activate_module functions in all versions up to, and including, 2.4.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to modify plugin settings or conduct SQL injection attacks.
Apr 7, 2024RapidLoad Power-Up for Autoptimize: Server-Side Request Forgery (SSRF)CVE-2024-31288 · affects up to 2.2.11 · reported by PatchstackHigh 7.2
Server-Side Request Forgery (SSRF) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize.This issue affects RapidLoad Power-Up for Autoptimize: from n/a through 2.2.11.
Jun 22, 2023Auth.CVE-2022-47593 · affects up to 1.6.35 · reported by PatchstackHigh 8.5
Auth. (subscriber+) SQL Injection (SQLi) vulnerability in RapidLoad RapidLoad Power-Up for Autoptimize plugin <= 1.6.35 versions.
Mar 17, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1472 · affects up to 1.7.1 · reported by WordfenceMedium 6.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to invoke those functions, via forged request granted they can trick a site administrator into performing an action such as clicking on a link. Actions include resetting the API key, accessing or deleting log files, and deleting cache among others.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1346 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the clear_page_cache function. This makes it possible for unauthenticated attackers to clear the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1345 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the queue_posts function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1344 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the uucss_update_rule function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1343 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the attach_rule function. This makes it possible for unauthenticated attackers to modify the plugin's cache via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1342 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the ucss_connect function. This makes it possible for unauthenticated attackers to connect the site to a new license key via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1341 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the ajax_deactivate function. This makes it possible for unauthenticated attackers to turn off caching via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Cross-Site Request ForgeryCVE-2023-1340 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.7.1. This is due to missing or incorrect nonce validation on the clear_uucss_logs function. This makes it possible for unauthenticated attackers to clear plugin logs via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized settings updateCVE-2023-1339 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the uucss_update_rule function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to update caching rules.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized cache modificationCVE-2023-1338 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the attach_rule function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to modify cache rules.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized data lossCVE-2023-1337 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized data loss due to a missing capability check on the clear_uucss_logs function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to delete plugin log files.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized settings updateCVE-2023-1336 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check on the ajax_deactivate function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to disable caching.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized plugin settings updateCVE-2023-1335 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the ucss_connect function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to connect a new license key to the site.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized cache modificationCVE-2023-1334 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized cache modification due to a missing capability check on the queue_posts function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to modify the plugin's cache.
Mar 10, 2023RapidLoad Power-Up for Autoptimize: Unauthorized loss of dataCVE-2023-1333 · affects up to 1.7.1 · reported by WordfenceMedium 4.3
The RapidLoad Power-Up for Autoptimize plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the clear_page_cache function in versions up to, and including, 1.7.1. This makes it possible for authenticated attackers with subscriber-level access to delete the plugin's cache.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.