xSpeed Cache CVE-2026-109985

Exploitation requires an authenticated account with contributor-level privileges or higher on the target WordPress site (per CVSS PR:L and the description), and the attacker must be able to submit content through the plugin's 'content' parameter handled by the Lazy loader module. The payload only triggers when another user subsequently loads the page containing the injected content, so impact depends on a victim viewing the affected page. Limiting factors: the requirement for a pre-existing contributor account meaningfully reduces exposure on single-author or tightly controlled sites, while multi-author / open-registration sites running xSpeed Cache ≤1.4.2 are most at risk.

This is a moderate, not a top-priority, issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4 Medium) shows network-reachable, low-complexity exploitation but requires authenticated access at contributor level or above (PR:L), which materially shrinks the attacker pool to users who already hold a posting account on the target WordPress site. The scope change (S:C) reflects that injected scripts execute in the context of other users (e.g., visitors or admins) who view the affected page, but confidentiality and integrity impact are only Low and availability is None. No EPSS score, CISA KEV listing, POC, or SSVC decision data were provided in the input; absence of these is not evidence of safety but means there is no signal of active or automatable exploitation at this time. On balance the signals are internally consistent - a real but conditional stored-XSS flaw, dangerous mainly on multi-author sites where untrusted contributors exist, rather than a mass-exploitable unauthenticated bug.

An attacker who has registered or obtained a contributor-level account on a WordPress site running xSpeed Cache (≤1.4.2) submits content containing a malicious script payload through the vulnerable 'content' parameter, which is stored without proper sanitization. When an administrator, editor, or site visitor later views the page containing the injected content, the script executes in their browser session. No public exploit code was identified in the provided data, but stored XSS of this class is straightforward to weaponize once contributor access is held.