EUVD-2026-53175
GHSA-ff83-hfr5-72ch
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Network-delivered reflected XSS with no auth (PR:N), requires user click (UI:R), scope changes to browser (S:C); no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams() function using PHP's loose inequality operator (!=) to compare the expected HMAC string against the JSON-decoded 'nonce' value - supplying the JSON boolean true causes any non-empty HMAC string to compare as loosely equal, bypassing the signature check - combined with insufficient output escaping in the _CbContentFinishSkip() function, which concatenates the attacker-controlled 'selfTest' field directly into the HTML response body. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
AnalysisAI
Reflected Cross-Site Scripting in the Seraphinite Accelerator WordPress plugin (versions ≤ 2.29.15) allows unauthenticated remote attackers to inject arbitrary JavaScript into victim browsers by exploiting a PHP type-juggling flaw that completely bypasses the plugin's HMAC signature verification. The root cause is a two-part chain: the CacheExtractPreparePageParams() function uses PHP's loose != operator to validate the nonce, which allows a JSON-decoded boolean true to compare as equal to any non-empty HMAC string, and the _CbContentFinishSkip() function then concatenates the attacker-controlled selfTest field from that unverified payload directly into the HTML response with no escaping. No public exploit or CISA KEV listing has been identified at time of analysis, but a patched version (2.29.18) is available and the Wordfence changeset confirms the vulnerable code paths.
Technical ContextAI
The affected component is a WordPress performance caching plugin by Seraphinitesoft (CPE: cpe:2.3:a:seraphinitesoft:seraphinite_accelerator:*:*:*:*:*:*:*:*). The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation). Specifically, the plugin uses an HMAC-based self-test mechanism triggered via the seraph_accel_prep URL parameter. The CacheExtractPreparePageParams() function in cache_ex.php (line 838) JSON-decodes the nonce field from this parameter and compares it to the expected HMAC using the loose inequality operator != rather than strict !== or a constant-time comparison. PHP's type coercion rules mean that the boolean true is loosely equal to any non-empty string, so supplying {"nonce": true, "selfTest": "<script>...</script>"} passes the signature check entirely. The _CbContentFinishSkip() function in common.php (line 6036) then writes the selfTest value into the HTML output without sanitization, completing the XSS sink. The changeset between plugin revisions 3619618 and 3624461 documents the fix applied in 2.29.18.
RemediationAI
Update the Seraphinite Accelerator plugin to version 2.29.18 or later immediately, as this version contains verified fixes to both the HMAC comparison logic in cache_ex.php and the output escaping in common.php per the Trac changesets (https://plugins.trac.wordpress.org/changeset?new=3624461%40seraphinite-accelerator%2Ftrunk%2Fcommon.php&old=3619618%40seraphinite-accelerator%2Ftrunk%2Fcommon.php). The fix should replace PHP's loose != with strict !== or a constant-time comparison function, and apply esc_html() or equivalent escaping before the selfTest value is written to output. If immediate patching is not possible, a compensating control is to disable the Seraphinite Accelerator plugin entirely until the update can be applied - the self-test endpoint that carries the vulnerable parameter is only reachable while the plugin is active, and disabling it carries no side effects beyond loss of caching performance. A Web Application Firewall rule blocking requests where seraph_accel_prep contains JSON boolean literals (e.g., the string true within the parameter value) may also reduce exposure, but should not substitute for patching. Refer to the full Wordfence advisory for additional details.
More in Seraphinite Accelerator
View allThe Seraphinite Accelerator WordPress plugin before 2.2.29 does not sanitise and escape a parameter before outputting it
The Seraphinite Accelerator WordPress plugin before 2.2.29 does not validate the URL to redirect any authenticated user
The Seraphinite Accelerator WordPress plugin before 2.20.32 does not have authorisation and CSRF checks when resetting a
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Seraphinite Soluti
The Seraphinite Accelerator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and
The Seraphinite Accelerator WordPress plugin through version 2.28.14 fails to validate user permissions on the `seraph_a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today