{"id":"CVE-2026-118784","kind":"vulnerability","aliases":["CVE-2026-118784"],"related":[],"title":"WPSpeed WordPress plugin: stored XSS via author archive pages","description":"The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a combination of two issues in the LightImages HTML optimizer: (1) Dispatcher::runOptimize() decides whether the current request is the site's home page by comparing only the URL path from REQUEST_URI against the path of the home URL, so on a plain-permalinks install the author archive URL /?author=<ID> is treated as the home page and the LightImages optimizer runs on it; and (2) LightImages::optimize() calls html_entity_decode() across the entire serialized DOMDocument output under the default-enabled img_processing_entity_decode setting, converting any entity-encoded markup present as plain text in the page (including WordPress's rendered author title) into live HTML. This makes it possible for authenticated attackers, with Subscriber-level access and above, to store entity-encoded markup in their own nickname/display_name through the normal profile endpoint and have that markup rehydrated into executing script when any logged-out visitor loads their author archive.","summary":"The WPSpeed plugin for WordPress, up to and including 2.6.10, decodes HTML entities across author archive pages, so a Subscriber can store a display name that runs script in other visitors' browsers. An attacker gets script execution in the context of any logged-out visitor who opens the attacker's author archive.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wpspeed"],"not_affected_if":["no-subscriber-registration","plugin-not-installed","pretty-permalinks"],"how_to_check":"- Check the installed WPSpeed plugin version in the WordPress admin plugins list or in the plugin's main file header against `2.6.10`\n- Check whether the LightImages image optimizer option `img_processing_entity_decode` is enabled (default on)\n- Check whether the site uses plain permalinks, which the flaw depends on","fix":"- WPSpeed plugin: versions above `2.6.10` (fixed version not stated in the sources)","status":"open","published_at":"2026-11-07T10:17:06+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","triaged_at":"2026-11-07T10:48:37+00:00","updated_at":"2026-11-07T10:48:37+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T10:48:37Z","model":"claude-haiku-5-5","output":{"fix":"- WPSpeed plugin: versions above `2.6.10` (fixed version not stated in the sources)","reach":"internet","title":"WPSpeed WordPress plugin: stored XSS via author archive pages","impact":"medium","summary":"The WPSpeed plugin for WordPress, up to and including 2.6.10, decodes HTML entities across author archive pages, so a Subscriber can store a display name that runs script in other visitors' browsers. An attacker gets script execution in the context of any logged-out visitor who opens the attacker's author archive.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wpspeed","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"yes","worst_case":"Script runs in visitors' browsers, enabling session theft or defacement","analyst_note":"","how_to_check":"- Check the installed WPSpeed plugin version in the WordPress admin plugins list or in the plugin's main file header against `2.6.10`\n- Check whether the LightImages image optimizer option `img_processing_entity_decode` is enabled (default on)\n- Check whether the site uses plain permalinks, which the flaw depends on","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","pretty-permalinks","no-subscriber-registration"],"who_is_affected":"Sites running WPSpeed up to and including 2.6.10 with plain permalinks and user registration allowing Subscriber accounts. The flaw needs a logged-in Subscriber account to store the payload, and affects logged-out visitors who open that author's archive. Sites on pretty permalinks or without the plugin are not in the described path.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000765,"input_tokens":4494,"output_tokens":631,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118784':12A,15A '-2026':11A,14A '1':109C '2':165C '2.6.10':31B,94C 'access':221C 'across':35B,172C 'archiv':8A,37B,74B,148C,256C 'attack':55B,71B,216C 'authent':215C 'author':7A,36B,73B,147C,150C,205C,255C 'browser':53B 'call':168C 'combin':100C 'compar':124C 'context':61B 'convert':188C 'cross':85C 'cross-sit':84C 'current':115C 'cve':10A,13A 'decid':112C 'decod':32B,171C,186C 'default':181C 'default-en':180C 'dispatch':110C 'display':45B 'domdocu':176C 'due':97C 'enabl':182C 'encod':192C,228C 'endpoint':238C 'entir':174C 'entiti':34B,170C,185C,191C,227C 'entity-encod':190C,226C 'execut':58B,245C 'get':56B 'home':121C,137C,155C 'host':19B 'html':33B,107C,169C,209C 'img':183C 'includ':30B,93C,201C 'instal':145C 'issu':103C 'level':220C 'lightimag':106C,159C,166C 'live':208C 'load':253C 'log':65B,250C 'logged-out':64B,249C 'make':211C 'markup':193C,229C,242C 'name':46B 'nickname/display_name':233C 'normal':236C 'open':69B 'optim':108C,160C,167C 'output':177C 'packag':16B 'page':9A,38B,122C,156C,200C 'path':128C,134C 'permalink':144C 'plain':143C,196C 'plain-permalink':142C 'plugin':3A,24B,77C 'possibl':213C 'present':194C 'process':184C 'profil':237C 'rehydr':243C 'render':204C 'request':116C,130C 'run':48B,161C 'runoptim':111C 'script':49B,57B,87C,246C 'self':18B 'self-host':17B 'serial':175C 'set':187C 'site':86C,119C 'store':4A,43B,83C,225C 'subscrib':41B,219C 'subscriber-level':218C 'text':197C 'titl':206C 'treat':152C 'two':102C 'uri':131C 'url':127C,138C,149C 'version':89C 'via':6A 'visitor':52B,67B,252C 'vulner':81C 'whether':113C 'wordpress':2A,20B,26B,79C,202C 'wpspeed':1A,21B,23B,76C 'xss':5A","nicknames":[],"mitigations":[],"who_affected":"Sites running WPSpeed up to and including 2.6.10 with plain permalinks and user registration allowing Subscriber accounts. The flaw needs a logged-in Subscriber account to store the payload, and affects logged-out visitors who open that author's archive. Sites on pretty permalinks or without the plugin are not in the described path.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress","wpspeed"],"campaign_type":null,"search_a":"'-118784':12A,15A '-2026':11A,14A 'archiv':8A 'author':7A 'cve':10A,13A 'page':9A 'plugin':3A 'store':4A 'via':6A 'wordpress':2A 'wpspeed':1A 'xss':5A","search_b":"'2.6.10':31B 'across':35B 'archiv':37B,74B 'attack':55B,71B 'author':36B,73B 'browser':53B 'context':61B 'decod':32B 'display':45B 'entiti':34B 'execut':58B 'get':56B 'host':19B 'html':33B 'includ':30B 'log':65B 'logged-out':64B 'name':46B 'open':69B 'packag':16B 'page':38B 'plugin':24B 'run':48B 'script':49B,57B 'self':18B 'self-host':17B 'store':43B 'subscrib':41B 'visitor':52B,67B 'wordpress':20B,26B 'wpspeed':21B,23B","search_c":"'1':109C '2':165C '2.6.10':94C 'access':221C 'across':172C 'archiv':148C,256C 'attack':216C 'authent':215C 'author':147C,150C,205C,255C 'call':168C 'combin':100C 'compar':124C 'convert':188C 'cross':85C 'cross-sit':84C 'current':115C 'decid':112C 'decod':171C,186C 'default':181C 'default-en':180C 'dispatch':110C 'domdocu':176C 'due':97C 'enabl':182C 'encod':192C,228C 'endpoint':238C 'entir':174C 'entiti':170C,185C,191C,227C 'entity-encod':190C,226C 'execut':245C 'home':121C,137C,155C 'html':107C,169C,209C 'img':183C 'includ':93C,201C 'instal':145C 'issu':103C 'level':220C 'lightimag':106C,159C,166C 'live':208C 'load':253C 'log':250C 'logged-out':249C 'make':211C 'markup':193C,229C,242C 'nickname/display_name':233C 'normal':236C 'optim':108C,160C,167C 'output':177C 'page':122C,156C,200C 'path':128C,134C 'permalink':144C 'plain':143C,196C 'plain-permalink':142C 'plugin':77C 'possibl':213C 'present':194C 'process':184C 'profil':237C 'rehydr':243C 'render':204C 'request':116C,130C 'run':161C 'runoptim':111C 'script':87C,246C 'serial':175C 'set':187C 'site':86C,119C 'store':83C,225C 'subscrib':219C 'subscriber-level':218C 'text':197C 'titl':206C 'treat':152C 'two':102C 'uri':131C 'url':127C,138C,149C 'version':89C 'visitor':252C 'vulner':81C 'whether':113C 'wordpress':79C,202C 'wpspeed':76C","first_public_at":"2026-11-07T10:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118784","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118784","severity":null,"published_at":"2026-11-07T10:17:06+00:00","modified_at":"2026-11-07T10:17:07+00:00","first_seen_at":"2026-11-07T10:46:40+00:00","fetched_at":"2026-11-07T10:46:40+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}