CVE-2026-2300 is a stored cross-site scripting vulnerability in the BJ Lazy Load WordPress plugin (versions up to 1.0.9). The issue stems from the filter_images() function using regex-based HTML processing (preg_replace) that fails to correctly handle HTML attribute boundaries when replacing src attributes. This flaw allows crafted content placed inside a class attribute to be promoted to actual DOM attributes after processing, enabling authenticated users with Contributor-level permissions or higher to inject arbitrary JavaScript code. The injected scripts execute in the context of any user who accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS score of 6.4, reflecting moderate impact on confidentiality and integrity but no impact on availability. No vendor patch or official remediation has been published yet.

An authenticated attacker with Contributor-level or higher access can inject persistent malicious scripts into pages via the BJ Lazy Load plugin. These scripts execute in the browsers of users who view the affected pages, potentially compromising user sessions or data confidentiality and integrity. The vulnerability does not affect availability. There are no known public exploits currently reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider disabling or replacing the BJ Lazy Load plugin to prevent exploitation. Monitor for updates from the vendor regarding patches or official mitigations.