CVE-2026-15421 Overview
CVE-2026-15421 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Speed Optimizer – The All-In-One Performance-Boosting Plugin for WordPress. The flaw affects all versions up to and including 7.8.0. It stems from insufficient input sanitization and output escaping in image tag attributes processed by the plugin's Lazy Load Media feature. Authenticated attackers with contributor-level access or above can inject arbitrary web scripts into pages. Injected scripts execute in the browsers of any users who view the affected pages. Exploitation requires the site administrator to have enabled the Lazy Load Media option in plugin settings.
Critical Impact
Contributor-level attackers can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, redirection, or administrative action abuse when the Lazy Load Media option is enabled.
Affected Products
- Speed Optimizer – The All-In-One Performance-Boosting Plugin (sg-cachepress) for WordPress
- All versions up to and including 7.8.0
- Sites with the Lazy Load Media option enabled
Discovery Timeline
- 2026-08-19 - CVE-2026-15421 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-15421
Vulnerability Analysis
The vulnerability resides in the Lazy Load Media component of the Speed Optimizer plugin. The plugin rewrites <img> tags at rendering time to defer image loading, but it fails to sanitize attribute values or escape them on output. When a contributor embeds an image with attacker-controlled attribute content, the plugin propagates that content into the rewritten markup without neutralizing script-injection payloads.
Because the payload is stored inside post content and reprocessed on every page render, the XSS is persistent. Execution occurs in the browser context of any visitor to the affected page, including authenticated administrators. This creates a cross-privilege attack path from contributor role to administrator session compromise.
The scope change indicated by the CVSS scope metric reflects that script execution crosses from the plugin's rendering context into the broader authenticated WordPress session of the viewing user.
Root Cause
The root cause is missing input validation and output escaping in the Lazy_Load_Images class and its parent Abstract_Lazy_Load in the sg-cachepress plugin. The image attribute rewriting logic accepts arbitrary attribute strings from post content and reinjects them into HTML output without applying WordPress escaping functions such as esc_attr() or wp_kses().
Attack Vector
An authenticated user with contributor privileges or higher authors a post containing an image with a malicious attribute payload. Once the post is rendered, the Lazy Load Media processor rewrites the <img> markup and emits the attacker-supplied payload verbatim. Any user viewing the page executes the injected script under the site's origin. The attack is network-reachable, requires low privileges, and needs no user interaction beyond visiting the affected page.
See the vulnerable code paths in Abstract_Lazy_Load.php, Lazy_Load.php, and Lazy_Load_Images.php at the WordPress Plugin Repository.
Detection Methods for CVE-2026-15421
Indicators of Compromise
- Post or page content containing <img> tags with attribute values that include on* event handlers, javascript: URIs, or embedded <script> fragments.
- Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages containing lazy-loaded images.
- New or modified posts authored by contributor-level accounts that contain unusual HTML in image markup.
Detection Strategies
- Audit the wp_posts table for image tags whose attributes contain script sinks or event handlers using regular-expression queries.
- Review Speed Optimizer plugin settings and confirm whether the Lazy Load Media option is enabled, which is required for exploitation.
- Compare installed plugin version against the fixed release 7.8.1 referenced in WordPress Changeset 3642965.
Monitoring Recommendations
- Enable WordPress audit logging for post creation and updates by contributor and author roles.
- Deploy a Content Security Policy (CSP) that restricts inline script execution and report violations to a monitoring endpoint.
- Monitor administrator sessions for anomalous actions following visits to contributor-authored pages.
How to Mitigate CVE-2026-15421
Immediate Actions Required
- Update the Speed Optimizer plugin to version 7.8.1 or later on all WordPress sites.
- If patching is delayed, disable the Lazy Load Media option in the plugin settings to remove the exploitation prerequisite.
- Review and restrict contributor and author role assignments, removing accounts that no longer require posting privileges.
Patch Information
The vendor released version 7.8.1 of the sg-cachepress plugin, which adds proper sanitization and escaping to the lazy-load image attribute handling. Review the fix in WordPress Changeset from 7.8.0 to 7.8.1 and additional details in the Wordfence Vulnerability Advisory.
Workarounds
- Disable the Lazy Load Media option in the Speed Optimizer plugin until the site is updated to 7.8.1.
- Apply a web application firewall rule that blocks event handler attributes and javascript: URIs in <img> tag submissions.
- Restrict post-publishing privileges so that contributor content requires editor review before rendering to the public.
# Update the plugin via WP-CLI to the patched release
wp plugin update sg-cachepress --version=7.8.1
# Verify installed version
wp plugin get sg-cachepress --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
