The a3 Lazy Load plugin contains a regex bug in the _filter_videos() method that disrupts proper quoting of HTML attributes when it processes <video> elements. This bug is combined with unescaped output in the admin/template file, allowing a user with Contributor or higher privileges to insert a crafted <video> tag whose src attribute embeds a class=" substring. The plugin’s regex then consumes part of that attribute and causes the browser’s attribute parser to interpret attacker‑controlled text as the value of an event‑handler attribute (for example onfocus). When a post containing this payload is viewed in a browser, the injected script runs in the victim’s browser context. The effect is a classic stored cross‑site scripting flaw that can execute arbitrary JavaScript while a user is viewing the content. Because the code runs inside the victim’s browser, it may compromise the user’s session or expose information, but the CVE description does not specify what the injected script actually does. This flaw requires authentication at Contributor level; the attacker must create or edit a post that contains the malicious <video> element.

All installations of a3 Lazy Load version 2.7.6 or earlier on WordPress sites are vulnerable. Attacks can be carried out by any user who has Contributor or higher privileges on the affected WordPress installation. Version 2.7.7 and later contain the fix and are not vulnerable.

The vulnerability has a CVSS score of 6.4, indicating a moderate‑to‑high impact. It is not listed in CISA’s KEV catalog and EPSS data is not available. Because the exploit only requires a Contributor or higher role, which many sites grant to multiple users, a broad range of legitimate users can abuse it. The flaw does not provide server‑side code execution or privilege escalation; the impact is limited to the browser of any user who views the post, including administrators. The likelihood of exploitation is non‑negligible given the relative ease of crafting the payload and the low barriers to creating a post.