Description

The 10Web Booster WordPress plugin before 2.33.5 does not correctly validate an access token on an unauthenticated request handler and does not escape attacker-supplied stylesheet content before rendering it into the page head, allowing an unauthenticated attacker to store markup that executes as JavaScript in the browser of anonymous visitors to an affected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.7",
  "pubDate": "2026-08-19T06:17:33.010Z",
  "pubdate": "2026-08-19T06:17:33.010Z",
  "executiveSummary": "The 10Web Booster WordPress plugin before version 2.33.5 suffers from an unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The flaw resides in an unauthenticated request handler that fails to properly validate access tokens and lacks appropriate output encoding for attacker-supplied stylesheet content.\nAn unauthenticated remote attacker can exploit this vulnerability by submitting malicious stylesheet content containing arbitrary markup that executes as JavaScript when rendered directly into the page head of affected pages. This impacts anonymous site visitors viewing the compromised pages, potentially leading to session hijacking, credential theft, or unauthorized actions performed in the context of the victim's browser session.\nThe risk implication is critical due to the lack of required authentication, allowing drive-by exploitation against any visitor encountering the manipulated pages. Remediation requires updating the 10Web Booster plugin to version 2.33.5 or later.",
  "technicalDetails": "The vulnerability is rooted in two distinct security failures within the 10Web Booster plugin: improper access control validation and a lack of context-aware output encoding. The vulnerable component is an unauthenticated request handler designed to process stylesheet configurations or inputs.\nRoot Cause: The request handler fails to enforce strict access token validation, permitting unauthenticated actors to interact with backend processing logic. Furthermore, when the supplied stylesheet content is subsequently processed and rendered into the page head of the Document Object Model (DOM), the application fails to sanitize or escape the input, treating arbitrary attacker-controlled data as trusted HTML and script content.\nAttack Flow: 1. An unauthenticated attacker crafts a malicious payload disguised as or embedded within stylesheet content, incorporating executable JavaScript or HTML markup. 2. The attacker transmits this payload to the vulnerable unauthenticated request handler of the 10Web Booster plugin, bypassing token validation checks due to the flawed implementation. 3. The plugin accepts the malicious input and persists it within the database or application state without sanitization. 4. When an anonymous visitor requests an affected page, the application retrieves the stored stylesheet content and renders it directly into the page head. 5. The browser interprets the injected markup, executing the malicious JavaScript within the context of the victim's browser session.\nAffected Versions: 10Web Booster WordPress plugin prior to version 2.33.5.\nAuthentication Requirements: None (unauthenticated).\nPrivilege Requirements: None (anonymous).\nNetwork Exposure: Remote over HTTP/HTTPS.\nPost-Exploitation Impact: Execution of arbitrary JavaScript in the browser of site visitors, session token theft, DOM manipulation, redirection to malicious infrastructure, and potential compromise of authenticated user sessions if administrative pages are targeted."
}