Skip to content
OpenAdvisories

Vendor

SiteGround

12 known vulnerabilities.

SiteGround at a glance

Last 12 months
6
Critical · all time
2
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 3 5 December 2025: 1 vulnerability Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 1 vulnerability Jun July 2026: 1 vulnerability August 2026: 3 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202630
Jul 202610
Jun 202610
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202510
Nov 202500
Oct 202510
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400

Products

SiteGround Security 3 SiteGround Email Marketing 3 Speed Optimizer – The All-In-One Performance-Boosting Plugin 2 Security Optimizer – The All-In-One Protection Plugin 2 Speed Optimizer 1 AI Agent by SiteGround 1
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • High 8.1
    CVE-2026-82228

    WordPress SiteGround Security plugin <= 1.6.6 - 2FA Bypass vulnerability

    Unauthenticated Bypass Vulnerability in SiteGround Security <= 1.6.6 versions.

    SiteGround SiteGround Security
  • Medium 5.3
    CVE-2026-17153

    AI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint

    The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unau…

    SiteGround AI Agent by SiteGround Web / CMS
  • Medium 6.4
    CVE-2026-15421

    Speed Optimizer <= 7.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes

    The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping.…

    SiteGround Speed Optimizer – The All-In-One Performance-Boosting Plugin Web / CMS
  • High 7.1
    CVE-2026-57416

    WordPress SiteGround Email Marketing plugin <= 1.7.5 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.5.

    SiteGround SiteGround Email Marketing
  • Medium 5.3
    CVE-2026-24547

    WordPress SiteGround Email Marketing plugin <= 1.7.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.

    SiteGround SiteGround Email Marketing
  • Medium 5.3
    CVE-2025-66121

    WordPress SiteGround Security plugin <= 1.5.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SiteGround SiteGround Security sg-security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteGround Security: from n/a through <= 1.5.8.

    SiteGround SiteGround Security
  • Medium 6.5
    CVE-2025-62912

    WordPress SiteGround Email Marketing plugin <= 1.7.1 - Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SiteGround SiteGround Email Marketing siteground-email-marketing allows Stored XSS.This issue affects SiteGround Email Marketing: from n/a through <= 1.7.1.

    SiteGround SiteGround Email Marketing
  • Medium 5.4
    CVE-2024-38774

    WordPress Security Optimizer plugin <= 1.5.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SiteGround SiteGround Security allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteGround Security: from n/a through 1.5.0.

    SiteGround SiteGround Security
  • Critical 9.8
    CVE-2019-25217

    SiteGround Optimizer <= 5.0.12 - Missing Authorization

    The SiteGround Optimizer plugin for WordPress is vulnerable to authorization bypass leading to Remote Code Execution and Local File Inclusion in versions up to, and including, 5.0.12 due to incorrect use of an access control attribute on the switch_php functi…

    SiteGround Speed Optimizer – The All-In-One Performance-Boosting Plugin Web / CMS
  • Medium 5.3
    CVE-2024-32532

    WordPress Speed Optimizer plugin <= 7.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SiteGround Speed Optimizer.This issue affects Speed Optimizer: from n/a through 7.4.6.

    SiteGround Speed Optimizer
  • High 8.1
    CVE-2022-0993

    SiteGround Security <= 1.2.5 - Authorization Weakness to Authentication Bypass

    The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on the 2FA back-up code implementation that logs users in upon success…

    SiteGround Security Optimizer – The All-In-One Protection Plugin Web / CMS
  • Critical 9.8
    CVE-2022-0992

    SiteGround Security <= 1.2.5 - Authentication Bypass via 2FA Setup

    The SiteGround Security plugin for WordPress is vulnerable to authentication bypass that allows unauthenticated users to log in as administrative users due to missing identity verification on initial 2FA set-up that allows unauthenticated and unauthorized use…

    SiteGround Security Optimizer – The All-In-One Protection Plugin Web / CMS