CVE-2026-15421

Publié : 19 août 2026

Modifié : 19 août 2026

Score CVSS

6.4

MEDIUM

Description détaillée

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the site administrator has enabled the Lazy Load Media option in the plugin settings.

Vecteur d'attaque (CVSS)

Vecteur brut :CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Références et Patchs

https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.7.11/core/Lazy_Load/Abstract_Lazy_Load.php#L109 https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.7.11/core/Lazy_Load/Lazy_Load.php#L39 https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.7.11/core/Lazy_Load/Lazy_Load_Images.php#L31 https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.8.0/core/Lazy_Load/Abstract_Lazy_Load.php#L109 https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.8.0/core/Lazy_Load/Lazy_Load.php#L39 https://plugins.trac.wordpress.org/browser/sg-cachepress/tags/7.8.0/core/Lazy_Load/Lazy_Load_Images.php#L31 https://plugins.trac.wordpress.org/changeset?old_path=%2Fsg-cachepress/tags/7.8.0&new_path=%2Fsg-cachepress/tags/7.8.1 https://plugins.trac.wordpress.org/changeset?reponame=&new=3642965%40sg-cachepress%2Ftags%2F7.8.1&old=3581843%40sg-cachepress%2Ftags%2F7.8.0 https://www.wordfence.com/threat-intel/vulnerabilities/id/2626ad96-4346-4564-b6bd-0c226bd8dfd4?source=cve

Dernières Vulnérabilités

CVE-2026-76048

A flaw has been found in SourceCodester Simple Online Food Ordering System 1.0. The impacted element is an unknown function of the file /admin/ajax.php?action=login. Executing a manipulation of the argument Username can lead to sql injection. The attack may be performed from remote. The exploit has been published and may be used.

VOIR DÉTAILS

CVE-2026-76014

A vulnerability has been found in BusyBox up to 1.30.1. This vulnerability affects unknown code of the file networking/wget.c of the component FEATURE_WGET_TIMEOUT Handler. Such manipulation of the argument -T leads to null pointer dereference. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. The name of the patch is 83a40bf7a93c8ac093d33ab452222dd5b9eb57ff. A patch should be applied to remediate this issue.

VOIR DÉTAILS

CVE-2026-76008

A flaw has been found in Comfast CF-N1-S 2.6.0.1. This affects the function get_para_from_uri of the file /cgi-bin/mbox-config of the component URI Parameter Parsing. This manipulation of the argument width/height causes stack-based buffer overflow. The attack can be initiated remotely.

VOIR DÉTAILS