Speed Booster Pack <= 4.5.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Attributes
- ID
- WPSEC-2026-2736
- Plugin
- Speed Booster Pack ⚡ PageSpeed Optimization Suite (speed-booster-pack)
- Affected
- from 3.8.5 before 4.5.9.2
- Remediation
- Update to 4.5.9.2 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-08
- Attack surface
- Speed Booster Pack on WPSec AttackSurface
- Fix released
- Published
Description
The Speed Booster Pack ⚡ PageSpeed Optimization Suite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image, source and iframe attributes in post content in all versions up to, and including, 4.5.9.1. This is due to the lazy-load output rewriting. It matches the first ' src=' text anywhere in a tag, including inside another attribute value such as alt text, and inserts a double-quoted placeholder there. This closes the surrounding double-quoted attribute, so text that passed content filtering inside the attribute becomes live attributes such as event handlers. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page while lazy loading is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-2736/
- https://plugins.svn.wordpress.org/speed-booster-pack/tags/4.5.9.2/
- https://wordpress.org/plugins/speed-booster-pack/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS