CVE-2026-17532 is a reflected cross-site scripting vulnerability in the Seraphinite Accelerator WordPress plugin. The vulnerability arises from the CacheExtractPreparePageParams() function using PHP's loose inequality operator (!=) to compare an expected HMAC string against a JSON-decoded 'nonce' value. By supplying the JSON boolean true, an attacker can bypass the signature check due to loose comparison semantics. Additionally, the _CbContentFinishSkip() function concatenates the attacker-controlled 'selfTest' field directly into the HTML response without proper escaping. This combination enables unauthenticated attackers to inject arbitrary web scripts that execute when a victim clicks a specially crafted link.

An attacker can perform reflected cross-site scripting attacks, leading to the execution of arbitrary scripts in the context of the vulnerable website. This can result in limited confidentiality and integrity impacts, such as theft of user session data or manipulation of page content. The vulnerability requires user interaction (clicking a crafted link) and does not allow direct system compromise or denial of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking on untrusted links that include the 'seraph_accel_prep' parameter. Monitor official vendor channels for updates and apply any official patches once released.