{"id":"CVE-2026-115951","kind":"vulnerability","aliases":["CVE-2026-115951"],"related":[],"title":"Lazy Load for Videos WordPress plugin: stored XSS through version 2.18.11","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Weber Lazy Load for Videos lazy-load-for-videos allows Stored XSS.This issue affects Lazy Load for Videos: from n/a through 2.18.11.","summary":"The Lazy Load for Videos WordPress plugin by Kevin Weber does not neutralize input before writing it into web pages, which allows stored cross-site scripting. An attacker who can supply content the plugin later renders can run JavaScript in other users' browsers.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugins"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed version of the plugin named `lazy-load-for-videos` in the WordPress admin under Plugins, or with `wp plugin get lazy-load-for-videos --field=version`\n- Compare the result against `2.18.11`; anything at or below that version is in the stated range","fix":"- unknown: the sources do not name a fixed version; check the plugin's changelog or the WordPress.org plugin page for the first release after `2.18.11`\n- Until a fixed release is installed, deactivate the plugin if video lazy loading is not essential","status":"open","published_at":"2026-10-26T11:16:35+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","triaged_at":"2026-10-26T11:31:06+00:00","updated_at":"2026-10-26T11:31:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-26T11:31:06Z","model":"claude-haiku-5-5","output":{"fix":"- unknown: the sources do not name a fixed version; check the plugin's changelog or the WordPress.org plugin page for the first release after `2.18.11`\n- Until a fixed release is installed, deactivate the plugin if video lazy loading is not essential","reach":"internet","title":"Lazy Load for Videos WordPress plugin: stored XSS through version 2.18.11","impact":"medium","summary":"The Lazy Load for Videos WordPress plugin by Kevin Weber does not neutralize input before writing it into web pages, which allows stored cross-site scripting. An attacker who can supply content the plugin later renders can run JavaScript in other users' browsers.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugins","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Attacker script runs in visitors' and admins' browsers on the site","analyst_note":"Confirm the fixed plugin version and the minimum role needed to store the payload, using the NVD entry and the WordPress.org plugin changelog.","how_to_check":"- Check the installed version of the plugin named `lazy-load-for-videos` in the WordPress admin under Plugins, or with `wp plugin get lazy-load-for-videos --field=version`\n- Compare the result against `2.18.11`; anything at or below that version is in the stated range","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"WordPress sites running Lazy Load for Videos at version 2.18.11 or earlier are in the stated range. The sources do not say which roles can supply the stored content, so unknown whether only authors or contributors can trigger it. Sites that do not run this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000654,"input_tokens":3326,"output_tokens":643,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-115951':14A,17A '-2026':13A,16A '2.18.11':11A,107C 'affect':99C 'allow':47B,95C 'attack':54B 'browser':69B 'content':58B 'cross':50B,79C 'cross-sit':49B,78C 'cve':12A,15A 'generat':77C 'host':21B 'improp':70C 'input':39B,73C 'issu':98C 'javascript':65B 'kevin':34B,84C 'later':61B 'lazi':1A,27B,86C,91C,100C 'lazy-load-for-video':90C 'load':2A,28B,87C,92C,101C 'n/a':105C 'neutral':38B,71C 'packag':18B 'page':45B,76C 'plugin':6A,25B,32B,60B 'render':62B 'run':64B 'script':52B,81C 'self':20B 'self-host':19B 'site':51B,80C 'store':7A,48B,96C 'suppli':57B 'user':68B 'version':10A 'video':4A,30B,89C,94C,103C 'vulner':82C 'web':44B,75C 'weber':35B,85C 'wordpress':5A,22B,24B,31B 'wordpress-plugin':23B 'write':41B 'xss':8A 'xss.this':97C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running Lazy Load for Videos at version 2.18.11 or earlier are in the stated range. The sources do not say which roles can supply the stored content, so unknown whether only authors or contributors can trigger it. Sites that do not run this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T11:16:35+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-115951","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115951","severity":null,"published_at":"2026-10-26T11:16:35+00:00","modified_at":"2026-10-26T11:16:35+00:00","first_seen_at":"2026-10-26T11:29:40+00:00","fetched_at":"2026-10-26T11:29:40+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}