CVE-2026-2300 Overview
CVE-2026-2300 is a Stored Cross-Site Scripting (XSS) vulnerability in the BJ Lazy Load plugin for WordPress, affecting all versions up to and including 1.0.9 [CWE-79]. The flaw exists in the filter_images() function, which uses regex-based HTML processing through preg_replace to rewrite image src attributes. The regex fails to respect HTML attribute boundaries, allowing content placed inside a class attribute to be promoted into real DOM attributes after processing. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes when visitors render the affected page.
Critical Impact
Authenticated Contributors can persist JavaScript that runs in the browser of every visitor, enabling session theft, privilege escalation, and content defacement.
Affected Products
- BJ Lazy Load plugin for WordPress, versions up through 1.0.9
- WordPress sites permitting Contributor-level or higher registration
- WordPress installations that render lazy-loaded content via class-bjll.php
Discovery Timeline
- 2026-05-12 - CVE-2026-2300 published to the National Vulnerability Database
- 2026-05-12 - Last updated in NVD database
Technical Details for CVE-2026-2300
Vulnerability Analysis
The BJ Lazy Load plugin transforms post content before rendering so that images load lazily. The transformation is performed inside the filter_images() function in inc/class-bjll.php, which applies regex substitutions through preg_replace to rewrite <img>src attributes into placeholder values and move the original URL into a data- attribute. Regex cannot reliably parse HTML, and the patterns used in this function treat attribute content as flat text rather than as values bound by quoting rules.
When a Contributor crafts post content that places attacker-controlled markup inside a class attribute, the regex matches across the intended attribute boundary. The replacement output reorders or escapes characters in a way that promotes the injected fragment into independent DOM attributes such as onerror or onload. The browser then parses the resulting HTML and executes the embedded script in the context of any user who views the page.
The issue is server-side mutation of user-supplied HTML without contextual sanitization. Output filtering relies on string rewriting rather than on a DOM-aware parser, which is the underlying defect tracked as [CWE-79].
Root Cause
The root cause is unsafe regex-based HTML rewriting in filter_images(). The preg_replace patterns at inc/class-bjll.php lines 121 and 210 do not anchor on attribute quote characters, so content inside a class value can satisfy the src attribute pattern and bleed into the replacement string.
Attack Vector
An authenticated attacker with Contributor permissions or higher submits a post containing a crafted <img> tag whose class attribute embeds payload syntax mimicking attribute boundaries. After the plugin processes the post on render, the payload appears as live DOM event handler attributes. Any logged-in administrator or visitor who loads the page triggers script execution in their session context.
No verified proof-of-concept code is publicly available. Refer to the Wordfence Vulnerability Analysis and the affected source at class-bjll.php line 121 for technical detail.
Detection Methods for CVE-2026-2300
Indicators of Compromise
- Post or page content containing <img> tags whose class attribute embeds quote characters, onerror=, onload=, or javascript: substrings
- Unexpected DOM event handler attributes appearing on rendered pages that were not present in the post editor source
- New or modified posts authored by Contributor-level accounts immediately followed by administrator session anomalies
Detection Strategies
- Audit the wp_posts table for post_content values containing class="[^"]*on[a-z]+= patterns or encoded script delimiters
- Inspect server-rendered HTML for <img> tags where event handler attributes appear outside the original author input
- Review WordPress audit logs for Contributor accounts publishing or editing posts that include image markup with unusual class values
Monitoring Recommendations
- Enable a web application firewall rule set that flags stored XSS payloads in post_content submissions to /wp-admin/post.php
- Forward WordPress access and admin logs to a centralized SIEM and alert on Contributor role activity followed by administrative session events
- Monitor outbound requests from administrator browsers for unexpected destinations that may indicate cookie or token exfiltration
How to Mitigate CVE-2026-2300
Immediate Actions Required
- Deactivate the BJ Lazy Load plugin until a patched release is available, since all versions through 1.0.9 are affected
- Restrict the Contributor role to trusted accounts and disable open user registration where it is not required
- Review existing posts and pages for injected <img> tags with suspicious class attribute content and remove them
Patch Information
No fixed version is identified in the published advisory at the time of NVD publication on 2026-05-12. Track the Wordfence Vulnerability Analysis and the plugin source repository for an updated release.
Workarounds
- Remove or replace the BJ Lazy Load plugin with an actively maintained lazy-loading alternative
- Apply a web application firewall rule that strips event handler attributes and quote characters from class values in submitted post content
- Lower untrusted user privileges below Contributor so they cannot publish HTML that reaches filter_images()
# Disable the vulnerable plugin via WP-CLI until a fix is released
wp plugin deactivate bj-lazy-load
wp plugin delete bj-lazy-load
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
