What is the CVSS score of EUVD-2026-29388?

EUVD-2026-29388 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

BJ Lazy Load EUVD-2026-29388

| CVE-2026-2300 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-05-12 Wordfence

GHSA-xfmv-2x8g-8rjp

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:49 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 6.4

DescriptionCVE.org

The BJ Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the filter_images() function in all versions up to, and including, 1.0.9. This is due to the use of regex-based HTML processing (preg_replace) that does not properly handle HTML attribute boundaries when replacing src attributes, allowing crafted content inside a class attribute value to be promoted to real DOM attributes after processing. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in BJ Lazy Load plugin for WordPress versions up to 1.0.9 allows authenticated attackers with Contributor-level access to inject arbitrary web scripts via regex-based HTML attribute manipulation in the filter_images() function. The vulnerability exploits improper handling of HTML attribute boundaries during src attribute replacement, enabling attackers to promote malicious content from class attribute values into executable DOM attributes. When victims access injected pages, the injected scripts execute in their browsers with the privileges of the compromised site.

Technical ContextAI

The BJ Lazy Load plugin uses preg_replace() for regex-based HTML processing to transform image src attributes as part of lazy-loading functionality. The vulnerability exists in the filter_images() function (referenced at line 121 and line 210 in the affected code paths) where insufficient boundary validation during regex substitution allows specially crafted HTML attribute content to break out of its intended context. Specifically, malicious payloads embedded within a class attribute value can be manipulated through regex processing to become independent DOM attributes with executable content. This is a classic case of CWE-79 (Improper Neutralization of Input During Web Page Generation), where user-controlled data is not properly sanitized before being rendered in HTML output. The regex pattern fails to account for attribute quote handling and whitespace, allowing injection points where the regex replacement operation inadvertently promotes non-src content into valid HTML attributes.

RemediationAI

Update BJ Lazy Load to a patched version released after 1.0.9 (exact version number not provided in input data, but vendors typically use 1.0.10 or 1.1.0 for security patches). The fix requires replacing regex-based HTML attribute manipulation with proper HTML parsing using a DOM parser (e.g., PHP DOMDocument or HTMLSpecialChars functions for attribute escaping). Site administrators should navigate to WordPress Dashboard → Plugins, search for 'BJ Lazy Load', and apply the update immediately once available. If no patched version is available from the vendor within a defined timeframe, consider disabling the plugin entirely and switching to a maintained lazy-loading alternative (e.g., native browser lazy-loading via HTML5 loading='lazy' attribute, which requires no plugin). As a temporary workaround with significant limitations, restrict Contributor-level access to only highly trusted users and regularly audit post revisions for injected content using security plugins like Wordfence or Sucuri, though this does not prevent exploitation, only aids detection. Consult the Wordfence vulnerability page (https://www.wordfence.com/threat-intel/vulnerabilities/id/f443846f-4d70-4ca0-beeb-d2e839b14765?source=cve) for the exact patched version number and release date once available.