Speed Booster Pack <= 4.5.9.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
- ID
- WPSEC-2026-2735
- Plugin
- Speed Booster Pack ⚡ PageSpeed Optimization Suite (speed-booster-pack)
- Affected
- from 4.5.8 before 4.5.9.2
- Remediation
- Update to 4.5.9.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-08
- Attack surface
- Speed Booster Pack on WPSec AttackSurface
- Fix released
- Published
Description
The Speed Booster Pack ⚡ PageSpeed Optimization Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the comment author name in all versions up to, and including, 4.5.9.1. This is due to the lazy-load output rewriting. It matches the first ' src=' text anywhere in an img, source or iframe tag, including text inside another attribute value such as the alt text of a comment author's avatar. At that point it inserts a placeholder image URI that contains raw single quotes. This breaks the quoting of the single-quoted avatar attribute, so text that was escaped inside the attribute becomes live attributes such as event handlers. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user visits a page showing the comment while lazy loading is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2735/
- https://plugins.svn.wordpress.org/speed-booster-pack/tags/4.5.9.2/
- https://wordpress.org/plugins/speed-booster-pack/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS