CVE-2026-109990: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in gijo Flying Scripts: Delay JavaScript to Improve Site Speed & Performance

CVE-2026-109990 describes a stored cross-site scripting vulnerability in the Flying Scripts: Delay JavaScript to Improve Site Speed & Performance WordPress plugin affecting all versions up to and including 1.2.4. The vulnerability is due to improper neutralization of input during web page generation, specifically via the 'comment' parameter. Attackers can inject arbitrary web scripts because the plugin's output-buffer rewriter substitutes crafted HTML elements with double-quote-bearing content into attributes, bypassing WordPress's save-time sanitization. This allows execution of injected scripts in users' browsers when they visit the compromised pages.

An unauthenticated attacker can inject persistent malicious scripts that execute in the context of users visiting affected pages, potentially leading to session hijacking, data theft, or other client-side attacks. The vulnerability has a CVSS 3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity with no availability impact.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, consider disabling or removing the plugin to prevent exploitation. Avoid using affected versions (<=1.2.4) in production environments. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.