CVE-2026-100196: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wp_media LazyLoad Plugin – Lazy Load Images, Videos, and Iframes

CVE-2026-100196 is a stored cross-site scripting vulnerability in the LazyLoad Plugin – Lazy Load Images, Videos, and Iframes WordPress plugin (versions <=2.4.0). The flaw exists because the plugin insufficiently sanitizes and escapes the comment_content parameter, allowing attackers to embed malicious scripts. WordPress core's wp_kses_data allow-list does not remove the payload since it uses permitted tags and attributes, and the plugin's render-time str_replace promotes a concealed event handler to a real DOM attribute, enabling script execution. The attack requires administrative approval of the malicious comment before it affects other users.

Successful exploitation allows an unauthenticated attacker to inject and execute arbitrary web scripts in the context of the affected site, potentially leading to information disclosure or user session compromise. The vulnerability is limited by the requirement that a site administrator must approve the malicious comment before it is served to other visitors. There is no indication of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, site administrators should carefully review and validate comments before approval to prevent malicious payloads from being published. Consider disabling or restricting the use of the plugin if possible until remediation is confirmed.