CVE-2026-115951 is a stored cross-site scripting (XSS) vulnerability in Kevin Weber's Lazy Load for Videos plugin affecting versions before 2.18.12. The flaw involves improper neutralization of input during web page generation, allowing attackers with low privileges to inject malicious scripts that can be executed in the context of other users. This vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level. The issue is fixed in version 2.18.12.