CVE-2026-15421 is a stored cross-site scripting vulnerability in the Speed Optimizer – The All-In-One Performance-Boosting Plugin for WordPress. The flaw exists due to insufficient sanitization and escaping of image tag attributes, enabling authenticated contributors and above to inject arbitrary scripts. These scripts execute in the context of users visiting the injected pages. The vulnerability is only exploitable when the Lazy Load Media feature is enabled. No official patch or remediation guidance is currently documented.

An attacker with contributor-level access or higher can inject malicious scripts into pages via image tag attributes. These scripts execute in the browsers of users who visit the compromised pages, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability does not affect unauthenticated users directly and requires specific plugin settings to be enabled.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider disabling the Lazy Load Media option in the plugin settings to prevent exploitation. Restrict contributor-level access to trusted users only.