Stored Cross-Site Scripting Vulnerability in Flying Scripts Plugin by WordPress
CVE-2026-109990

7.2HIGH

Key Information:

Vendor

WordPress
Status
Flying Scripts: Delay Javascript To Improve Site Speed & Performance
Vendor
CVE Published:
16 October 2026

What is CVE-2026-109990?

The Flying Scripts plugin for WordPress is affected by a vulnerability that allows unauthenticated attackers to execute arbitrary web scripts on pages viewed by users. This occurs through the 'comment' parameter, where insufficient input sanitization and output escaping enable the injection of malicious scripts. Attackers can exploit this weakness without triggering the standard kses sanitization in WordPress by using allowed HTML elements in a clever way. By manipulating the output when the plugin rewrites output buffers, they can introduce XSS scripts that may compromise user data and site integrity.

Affected Version(s)

Flying Scripts: Delay JavaScript to Improve Site Speed & Performance 0 <= 1.2.4

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/flying-scripts...
https://plugins.trac.wordpress.org/browser/flying-scripts...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Santh
.