Stored Cross-Site Scripting Vulnerability in a3 Lazy Load Plugin for WordPress

CVE-2026-6427

What is CVE-2026-6427?

The a3 Lazy Load plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability across all versions up to and including 2.7.6. This flaw arises from a regex oversight in the _filter_videos() method that improperly handles HTML attribute quoting when parsing crafted elements. Consequently, malicious users with Contributor-level permissions can exploit this by injecting a specially crafted tag. This tag includes a src attribute that carries an embedded class=' substring, which manipulates the class-replacement regex, allowing an attacker to influence the HTML5 parser's quote boundaries. As a result, attacker-controlled text can escape the confines of a quoted attribute, enabling execution of arbitrary scripts in the browsers of any user—including administrators—viewing the post.

References