CVE-2026-96572: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in aguidrevitch WP Meteor Website Speed Optimization Addon

CVE-2026-96572 is a stored cross-site scripting vulnerability in the WP Meteor Website Speed Optimization Addon plugin for WordPress, affecting all versions up to 3.4.18. The vulnerability occurs due to improper neutralization of input in the comment author name field, allowing unauthenticated attackers to inject malicious scripts. These scripts execute in the context of users viewing the injected pages. The vulnerability stems from insufficient input sanitization and output escaping in the plugin. The payload must pass WordPress's comment moderation workflow before being displayed, which is a prerequisite for display but does not mitigate the vulnerability.

Successful exploitation allows unauthenticated attackers to inject and execute arbitrary web scripts in the context of users visiting affected pages, potentially leading to information disclosure and user session compromise. The CVSS 3.1 base score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality and integrity but not availability.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. As a temporary mitigation, administrators can enforce strict comment moderation policies to prevent malicious comment author names from being published. Additionally, consider disabling or removing the WP Meteor Website Speed Optimization Addon plugin until a fix is released.