CVE-2026-118784 · Package
NO FIX YET · SEE WHAT TO DO
The WPSpeed plugin for WordPress, up to and including 2.6.10, decodes HTML entities across author archive pages, so a Subscriber can store a display name that runs script in other visitors' browsers. An attacker gets script execution in the context of any logged-out visitor who opens the attacker's author archive.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running WPSpeed up to and including 2.6.10 with plain permalinks and user registration allowing Subscriber accounts. The flaw needs a logged-in Subscriber account to store the payload, and affects logged-out visitors who open that author's archive. Sites on pretty permalinks or without the plugin are not in the described path.
Not affected if no-subscriber-registration, plugin-not-installed, pretty-permalinks
Who cares self-hosted, wordpress, wpspeed
2.6.10img_processing_entity_decode is enabled (default on)2.6.10 (fixed version not stated in the sources)The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a combination of two issues in the LightImages HTML optimizer: (1) Dispatcher::runOptimize() decides whether the current request is the site's home page by comparing only the URL path from REQUEST_URI against the path of the home URL, so on a plain-permalinks install the author archive URL /?author=<ID> is treated as the home page and the LightImages optimizer runs on it; and (2) LightImages::optimize() calls html_entity_decode() across the entire serialized DOMDocument output under the default-enabled img_processing_entity_decode setting, converting any entity-encoded markup present as plain text in the page (including WordPress's rendered author title) into live HTML. This makes it possible for authenticated attackers, with Subscriber-level access and above, to store entity-encoded markup in their own nickname/display_name through the normal profile endpoint and have that markup rehydrated into executing script when any logged-out visitor loads their author archive.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.