CVE-2026-17532 is a reflected XSS vulnerability in the Seraphinite Accelerator plugin for WordPress. The flaw arises from the CacheExtractPreparePageParams() function using PHP's loose inequality operator (!=) to compare an expected HMAC string against a JSON-decoded 'nonce' value. Supplying the JSON boolean true causes the comparison to bypass the signature check. Additionally, the _CbContentFinishSkip() function concatenates the attacker-controlled 'selfTest' field directly into the HTML response without proper escaping. This combination allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users who click on maliciously crafted links.

An attacker can perform reflected cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the victim's browser. This can result in information disclosure or manipulation of user interactions within the affected web pages. The vulnerability requires user interaction (clicking a crafted link) and does not allow direct system compromise or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on untrusted links that might exploit this vulnerability. Monitoring vendor channels for updates and applying official patches once released is recommended.