The a3 Lazy Load WordPress plugin allows an authenticated attacker with contributor or higher privileges to inject arbitrary JavaScript into pages by exploiting insufficient sanitization of user supplied attributes. The injected script runs in the context of any user who views the affected page, enabling session hijacking, cookie theft, defacement or other malicious actions. This flaw implements the classic client‑side injection weakness documented by CWE‑79.

All installations of the a3 Lazy Load plugin by a3rev, versions 2.7.5 and earlier, are vulnerable when running on WordPress sites. Versions 2.8.0 and later contain the fix.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1 % suggests a low probability of exploitation at the time of analysis. The vulnerability is not currently catalogued in the CISA KEV list. Exploitation requires authenticated access at contributor level or above, so the attack surface is limited to sites with such roles, but the impact on any user who views an injected page is significant.