CVE-2026-2902 is a stored cross-site scripting vulnerability in the WP Meteor Website Speed Optimization Addon WordPress plugin, specifically in the 'frontend_rewrite' function's handling of the 'WPMETEOR[N]WPMETEOR' placeholder content. Due to improper neutralization of input, unauthenticated attackers can inject malicious scripts that persist and execute in the context of users visiting the compromised pages. This vulnerability affects all plugin versions up to 3.4.16. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. No vendor patch or official remediation is currently documented.

Successful exploitation allows unauthenticated attackers to inject persistent malicious scripts into web pages served by the vulnerable plugin. These scripts execute in the browsers of users who visit the injected pages, potentially leading to information disclosure and integrity impacts within the scope of the affected site. The vulnerability does not impact availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the WP Meteor Website Speed Optimization Addon plugin or applying manual input sanitization and output escaping if feasible. Monitor official vendor channels for updates and patches addressing this vulnerability.