CVE-2026-15421: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in siteground Speed Optimizer – The All-In-One Performance-Boosting Plugin
The Speed Optimizer – The All-In-One Performance-Boosting Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 7.8.0. This vulnerability arises from insufficient input sanitization and output escaping of image tag attributes. It allows authenticated users with contributor-level access or higher to inject arbitrary scripts that execute when other users view the affected pages. Exploitation requires the Lazy Load Media option to be enabled in the plugin settings.
AI Analysis
Technical Summary
CVE-2026-15421 is a stored cross-site scripting vulnerability (CWE-79) in the Speed Optimizer plugin for WordPress. The flaw exists due to improper neutralization of input during web page generation, specifically in image tag attributes. Authenticated attackers with contributor or higher privileges can inject malicious scripts that execute in the context of users visiting the injected pages. This vulnerability is only exploitable if the Lazy Load Media feature is enabled. The affected versions are all plugin versions from 0 up to and including 7.8.0.
Potential Impact
Successful exploitation allows an authenticated contributor or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect unauthenticated users directly and requires specific plugin configuration (Lazy Load Media enabled). There is no indication of impact on availability or server integrity.
Mitigation Recommendations
No official patch or fix is currently indicated in the provided data. Users should verify the vendor advisory for updates. Until a patch is available, administrators should consider disabling the Lazy Load Media option to prevent exploitation. Additionally, restrict contributor-level access to trusted users only. Monitor vendor channels for official fixes and apply them promptly once released.
CVE-2026-15421: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in siteground Speed Optimizer – The All-In-One Performance-Boosting Plugin
Description
The Speed Optimizer – The All-In-One Performance-Boosting Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 7.8.0. This vulnerability arises from insufficient input sanitization and output escaping of image tag attributes. It allows authenticated users with contributor-level access or higher to inject arbitrary scripts that execute when other users view the affected pages. Exploitation requires the Lazy Load Media option to be enabled in the plugin settings.
CVSS v3.1
Score 6.4medium
Affected software
siteground
Speed Optimizer – The All-In-One Performance-Boosting Plugin
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-15421 is a stored cross-site scripting vulnerability (CWE-79) in the Speed Optimizer plugin for WordPress. The flaw exists due to improper neutralization of input during web page generation, specifically in image tag attributes. Authenticated attackers with contributor or higher privileges can inject malicious scripts that execute in the context of users visiting the injected pages. This vulnerability is only exploitable if the Lazy Load Media feature is enabled. The affected versions are all plugin versions from 0 up to and including 7.8.0.
Potential Impact
Successful exploitation allows an authenticated contributor or higher to inject and execute arbitrary JavaScript in the context of other users viewing the affected pages. This can lead to information disclosure, session hijacking, or other client-side impacts. The vulnerability does not affect unauthenticated users directly and requires specific plugin configuration (Lazy Load Media enabled). There is no indication of impact on availability or server integrity.
Mitigation Recommendations
No official patch or fix is currently indicated in the provided data. Users should verify the vendor advisory for updates. Until a patch is available, administrators should consider disabling the Lazy Load Media option to prevent exploitation. Additionally, restrict contributor-level access to trusted users only. Monitor vendor channels for official fixes and apply them promptly once released.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- Wordfence
- Date Reserved
- 2026-07-10T15:11:57.894Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6a850bc4c6e8be0332ff00a1
Added to database: 08/19/2026, 01:49:56 UTC
Last enriched: 09/11/2026, 10:18:18 UTC
Last updated: 10/02/2026, 02:46:02 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.