CVE-2026-107742 Overview
The 10Web Booster plugin for WordPress contains a stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 2.34.8. Unauthenticated attackers can inject arbitrary JavaScript through the comment author parameter. The payload survives WordPress core's sanitize_text_field function because it contains no HTML tags or quote characters. The plugin's str_replace operation later introduces a single quote that breaks out of the alt attribute context, enabling script execution for any visitor viewing the affected page.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript that executes in the browser of every visitor to pages containing the poisoned comment, enabling session theft, credential harvesting, and administrative account takeover.
Affected Products
- 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress
- All versions up to and including 2.34.8
- Fixed in version 2.34.10
Discovery Timeline
- 2026-10-10 - CVE-2026-107742 published to the National Vulnerability Database
- 2026-10-13 - Last updated in NVD database
Technical Details for CVE-2026-107742
Vulnerability Analysis
The flaw is a stored XSS classified under [CWE-79]. It exists in the 10Web Booster plugin's image optimization code paths in OptimizerImages.php and tenweb_speed_optimizer.php. When the plugin processes comment author names for use within image alt attributes, it fails to apply sufficient output escaping. An attacker submits a comment with an author Name crafted to include src= followed by an event handler payload. Because the payload contains no angle brackets or quote characters, WordPress core sanitization passes it through unchanged. The plugin then performs a str_replace operation that introduces a single quote into the already-attacker-controlled string, prematurely closing the alt attribute. The injected src= and event handler then execute as valid HTML attributes on the surrounding <img> tag.
Root Cause
The root cause is reliance on sanitize_text_field as the sole defense before placing untrusted input into an HTML attribute context. sanitize_text_field strips tags but does not escape attribute delimiters or event handlers. Subsequent string manipulation in the plugin reintroduces quote characters, breaking the attribute boundary. Proper mitigation requires esc_attr on all values written into HTML attributes.
Attack Vector
An unauthenticated attacker submits a comment on any post using a crafted author name. When the 10Web Booster plugin later serves the page and generates optimized image markup referencing that comment author, the payload is rendered inside an <img>alt attribute. The attacker-controlled str_replace interaction closes the attribute and introduces new attributes containing JavaScript event handlers. Any user, including administrators, who views the page triggers execution of attacker-supplied script in their browser session. See the Wordfence Vulnerability ID b14945 advisory and the vulnerable source at OptimizerImages.php Line 186 for details.
Detection Methods for CVE-2026-107742
Indicators of Compromise
- Comments in the WordPress database (wp_comments.comment_author) containing substrings such as src=, onerror=, onload=, or onmouseover=.
- Rendered pages where <img>alt attributes contain unexpected src= or JavaScript event handler fragments.
- Outbound requests from visitor browsers to unfamiliar domains originating from pages that display comments.
- Unexpected administrator session activity or new privileged accounts created shortly after public comment submissions.
Detection Strategies
- Audit the wp_comments table for comment_author values containing HTML attribute syntax or event handler keywords.
- Deploy web application firewall rules that inspect comment submission POST bodies for src=, on[a-z]+=, and similar patterns in the author field.
- Compare installed plugin versions against the fixed 2.34.10 release across all WordPress sites in inventory.
Monitoring Recommendations
- Log and alert on comment submissions where the author name contains non-standard characters or attribute-like syntax.
- Monitor WordPress administrator sessions for anomalous actions following page views containing user-generated comments.
- Track Content Security Policy violation reports to identify inline script execution attempts on comment-bearing pages.
How to Mitigate CVE-2026-107742
Immediate Actions Required
- Update the 10Web Booster plugin to version 2.34.10 or later on all WordPress installations.
- Review the wp_comments table and remove or sanitize entries with suspicious author names.
- Rotate credentials for any administrator account that may have viewed poisoned pages prior to patching.
- Invalidate active WordPress sessions to force re-authentication after remediation.
Patch Information
The vendor released a fix in WordPress Plugin Version 2.34.10. The patch addresses the insufficient output escaping in the image optimization code paths referenced at OptimizerImages.php Line 310 and OptimizerImages.php Line 445.
Workarounds
- Disable the 10Web Booster plugin until the update to 2.34.10 can be applied.
- Disable comments site-wide or restrict comment submission to authenticated users as a temporary control.
- Deploy a Content Security Policy that forbids inline scripts and restricts script sources to trusted origins.
- Apply web application firewall rules that block comment author values containing HTML attribute or event handler syntax.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
