CVE-2026-107742: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in 10web 10Web Booster – Website speed optimization, Cache & Page Speed optimizer

CVE-2026-107742 is a stored cross-site scripting vulnerability in the 10Web Booster – Website speed optimization, Cache & Page Speed optimizer WordPress plugin. The vulnerability exists in all versions up to and including 2.34.8 and is caused by improper neutralization of input during web page generation (CWE-79). Specifically, the 'author' parameter in comments can contain crafted input that bypasses WordPress's sanitize_text_field function and is subsequently manipulated by the plugin's str_replace function to break out of the alt attribute context, enabling injection of arbitrary JavaScript code. This flaw allows unauthenticated attackers to execute scripts in the context of users visiting the injected pages.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, leading to potential user session hijacking, defacement, or other malicious actions executed in the context of affected users. The vulnerability has a CVSS 3.1 score of 7.2 (high severity), indicating significant risk due to network attack vector, low attack complexity, no privileges required, and no user interaction needed.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider disabling or removing the plugin or applying any recommended temporary mitigations from the vendor. Monitoring vendor channels for updates is advised.