Read the docs
TI-2026-70223 Aliases CVE-2026-100196GHSA-mj58-4j67-93fr

Stored cross-site scripting in LazyLoad Plugin for WordPress

Priority LOW 31CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The LazyLoad Plugin for WordPress is affected in all versions up to and including 2.4.0. Insufficient input sanitization and output escaping of the comment_content parameter let crafted comments store script that the plugin renders into page HTML (CWE-79). An unauthenticated attacker can inject arbitrary web scripts that run when a user accesses an injected page, but a site administrator must first approve the crafted comment.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline into the page HTML)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. WordPress core's wp_kses_data allow-list does not strip the crafted payload on save because it uses only permitted tags and attributes; the event handler is concealed inside a broken attribute region and is only promoted to a real DOM attribute by the plugin's render-time str_replace transformation. Additionally, a site administrator must approve the crafted comment before the payload is served to other visitors.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00292 21st percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
WP MediaLazyLoad Plugin – Lazy Load Images, Videos, and Iframesup to 2.4.0—No fix listedCNA
  • LazyLoad Plugin – Lazy Load Images, Videos, and Iframes VendorWP Media Affected up to 2.4.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for LazyLoad Plugin.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-10 Threatist record created from CVE-2026-100196
  2. 2026-10-10 Alias added: GHSA-mj58-4j67-93fr
  3. 2026-10-11 CISA SSVC decision points changed
  4. 2026-10-11 Priority changed: MEDIUM → LOW

References

Other 10

  • TI-2024-03858 Search & Replace < 3.2.2 - Admin+ SQL injection CVSS 3.1HIGH 7.2
  • TI-2024-25993 WordPress Search & Replace plugin <= 3.2.2 - Deserialization of untrusted data vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2026-69868 Code injection in WordPress WP Rocket plugin CVSS 3.1HIGH 7.5
  • TI-2023-05067 BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal CVSS 3.1HIGH 8.7
  • TI-2026-05204 Cross-site scripting in WP Rocket CVSS 3.1HIGH 7.2
  • TI-2026-05464 BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter CVSS 3.1HIGH 7.2
See all 15 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences