The Seraphinite Accelerator plugin for WordPress contains a reflected XSS flaw exposed through the 'seraph_accel_prep' parameter. The plugin’s CacheExtractPreparePageParams() function uses PHP’s loose inequality operator to compare an HMAC against the JSON-decoded 'nonce' value. By supplying the JSON boolean true as the HMAC, any non‑empty HMAC string passes validation, allowing an attacker to inject arbitrary JavaScript via the 'selfTest' field which is concatenated unescaped into the HTML response by _CbContentFinishSkip(). An unauthenticated attacker can exploit this by sending a victim a crafted link that triggers the script execution, enabling cookie theft, session hijacking, defacement or malware delivery.

Seraphinite Accelerator plugin for WordPress, versions 2.29.15 and earlier (the CVE title indicates that releases up to 2.29.18 may also be affected). This plugin is installed on WordPress‑based websites.

CVSS score 6.1 flags a medium‑severity vulnerability. The EPSS score is not available, so the exact exploitation probability is uncertain. The flaw is not listed in the CISA KEV catalogue. Attackers can exploit it remotely without authentication by luring users to specially crafted links; because the plugin is widely deployed, the attack surface is broad, raising the overall risk for affected sites until a fix is applied.