Description

The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Image Tag Attributes in all versions up to, and including, 7.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the site administrator has enabled the Lazy Load Media option in the plugin settings.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-19T02:16:12.677Z",
  "pubdate": "2026-08-19T02:16:12.677Z",
  "executiveSummary": "The Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via Image Tag Attributes. This security flaw exists in all versions up to, and including, 7.8.0.\nThe vulnerability arises due to insufficient input sanitization and output escaping mechanisms implemented within the plugin.\nAuthenticated attackers with contributor-level access and above can leverage this weakness to inject arbitrary web scripts into pages. These injected scripts execute whenever an unsuspecting user accesses the compromised page.\nExploitation of this vulnerability requires the site administrator to have explicitly enabled the Lazy Load Media option within the plugin settings.\nThe risk implications include potential session hijacking, unauthorized actions performed on behalf of other users, defacement, and further compromise of the WordPress environment depending on the privileges of the victim interacting with the injected payload.",
  "technicalDetails": "The root cause of the vulnerability stems from inadequate input sanitization and a lack of proper output escaping on image tag attributes processed by the Speed Optimizer – The All-In-One Performance-Boosting Plugin plugin.\nThe vulnerable component is tied to the media handling routines executed when the Lazy Load Media option is enabled by the site administrator in the plugin settings.\nAuthentication and privilege requirements dictate that the attacker must possess authenticated access with contributor-level privileges or higher within the WordPress installation.\nNetwork exposure is defined by the web accessibility of the target WordPress instance, allowing authenticated users to interact with the administrative or post-creation interfaces.\nThe attack flow proceeds as follows: First, an authenticated attacker with contributor-level permissions crafts a malicious payload encapsulated within image tag attributes. Second, the attacker submits this input through standard post or content creation mechanisms managed or processed by the plugin. Third, because the plugin fails to properly sanitize the input or escape the output when rendering image tags under the Lazy Load Media feature, the malicious script is persistently stored in the database. Fourth, when any user—including high-privileged administrators—accesses the affected page containing the injected image tags, the stored script is retrieved and executed within the context of the victim's browser session.\nThe payload behavior involves executing arbitrary JavaScript in the Document Object Model (DOM) of the victim's browser session, enabling post-exploitation impacts such as session token theft, redirection to malicious resources, or the unauthorized execution of administrative functions if a privileged user views the injected content."
}