Description
The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a combination of two issues in the LightImages HTML optimizer: (1) Dispatcher::runOptimize() decides whether the current request is the site's home page by comparing only the URL path from REQUEST_URI against the path of the home URL, so on a plain-permalinks install the author archive URL /?author=<ID> is treated as the home page and the LightImages optimizer runs on it; and (2) LightImages::optimize() calls html_entity_decode() across the entire serialized DOMDocument output under the default-enabled img_processing_entity_decode setting, converting any entity-encoded markup present as plain text in the page (including WordPress's rendered author title) into live HTML. This makes it possible for authenticated attackers, with Subscriber-level access and above, to store entity-encoded markup in their own nickname/display_name through the normal profile endpoint and have that markup rehydrated into executing script when any logged-out visitor loads their author archive.
Published: 2026-11-07
Score: 6.4 Medium
EPSS: n/a
KEV: No
Impact: Stored Cross‑Site Scripting affecting external visitors
Action: Patch
AI Analysis

Impact

The WPSpeed plugin up to version 2.6.10 is vulnerable to stored cross‑site scripting. An attacker who is a subscriber or higher can store entity‑encoded markup in their WordPress nickname or display name. On a public author archive the LightImages optimizer mis‑identifies the page as the site’s home page and decodes the entities, turning the stored markup into executable HTML that runs in the browser of any logged‑out visitor who views the author page.

Affected Systems

All installations of the WordPress WPSpeed plugin produced by John Dagelmores, specifically any release with a version number of 2.6.10 or earlier. The vulnerability is present regardless of WordPress permalink settings.

Risk and Exploitability

The CVSS score of 6.4 classifies the flaw as moderate to high risk. No EPSS score is available, so the likelihood of exploitation is uncertain, and the issue is not listed in the CISA KEV catalog. Exploitation requires that the attacker has Subscriber‑level access to modify their profile, and that the site publicly serves author archives to unprivileged visitors.

Generated by OpenCVE AI on November 7, 2026 at 10:51 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the WPSpeed plugin to a version newer than 2.6.10 that removes the HTML decoding flaw.
  • If an upgrade cannot be performed promptly, sanitize or remove any entity‑encoded characters from user nicknames and display names to prevent rendering of malicious markup.
  • Disable public author archives or restrict access to logged‑in users to stop unauthenticated visitors from loading attacker‑controlled content.

Generated by OpenCVE AI on November 7, 2026 at 10:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 07 Nov 2026 09:30:00 +0000

Type Values Removed Values Added
Description The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a combination of two issues in the LightImages HTML optimizer: (1) Dispatcher::runOptimize() decides whether the current request is the site's home page by comparing only the URL path from REQUEST_URI against the path of the home URL, so on a plain-permalinks install the author archive URL /?author=<ID> is treated as the home page and the LightImages optimizer runs on it; and (2) LightImages::optimize() calls html_entity_decode() across the entire serialized DOMDocument output under the default-enabled img_processing_entity_decode setting, converting any entity-encoded markup present as plain text in the page (including WordPress's rendered author title) into live HTML. This makes it possible for authenticated attackers, with Subscriber-level access and above, to store entity-encoded markup in their own nickname/display_name through the normal profile endpoint and have that markup rehydrated into executing script when any logged-out visitor loads their author archive.
Title WPSpeed <= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Name
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-11-07T09:25:46.871Z

Reserved: 2026-10-28T19:51:16.327Z

Link: CVE-2026-118784

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-07T10:17:06.970

Modified: 2026-11-07T10:17:07.107

Link: CVE-2026-118784

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-07T11:00:18Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')