Stored Cross-Site Scripting in a3 Lazy Load Plugin for WordPress

CVE-2025-9873

What is CVE-2025-9873?

The a3 Lazy Load plugin for WordPress exhibits a vulnerability that allows authenticated users, such as contributors and higher, to inject arbitrary web scripts into pages. This issue arises from inadequate input sanitization and output escaping on user-supplied attributes. Once injected, these scripts can execute whenever a user accesses the compromised page, potentially leading to unauthorized actions and sensitive data exposure.

References