Live › vulnerability › CVE-2026-115951
Go to dashboardThe Lazy Load for Videos WordPress plugin by Kevin Weber does not neutralize input before writing it into web pages, which allows stored cross-site scripting. An attacker who can supply content the plugin later renders can run JavaScript in other users' browsers.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 11:29 UTC. All times on this page are UTC.
WordPress sites running Lazy Load for Videos at version 2.18.11 or earlier are in the stated range. The sources do not say which roles can supply the stored content, so unknown whether only authors or contributors can trigger it. Sites that do not run this plugin can skip it.
No product ranges from the sources yet.
lazy-load-for-videos in the WordPress admin under Plugins, or with wp plugin get lazy-load-for-videos --field=version2.18.11; anything at or below that version is in the stated range2.18.11Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Weber Lazy Load for Videos lazy-load-for-videos allows Stored XSS.This issue affects Lazy Load for Videos: from n/a through 2.18.11.
This page as .md · .json · in your agent: get_signal("CVE-2026-115951")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.