The 10Web Booster WordPress plugin versions prior to 2.33.5 contain a CWE-79 Cross-Site Scripting vulnerability. The issue arises because the plugin does not correctly validate access tokens on unauthenticated request handlers and fails to escape attacker-controlled stylesheet content before injecting it into the page head. As a result, an unauthenticated attacker can store malicious markup that executes arbitrary JavaScript in the context of anonymous visitors' browsers, potentially leading to session hijacking, defacement, or other client-side attacks.

An unauthenticated attacker can inject and store malicious JavaScript that executes in the browsers of anonymous visitors to affected pages. This can lead to client-side attacks such as session hijacking, theft of sensitive information, or unauthorized actions performed on behalf of the user. The vulnerability affects the confidentiality and integrity of user interactions with the affected website.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor the 10Web Booster plugin vendor announcements for an official fix. Until a patch is available, consider disabling the plugin or restricting access to affected functionality to mitigate risk.