10Web Booster EUVD-2026-96210

Requires that the target WordPress site runs 10Web Booster ≤2.34.8 with its image-optimization output path active and accepts comments, so that an attacker-supplied comment author Name is processed and rendered into an image alt attribute. The payload must be crafted precisely - containing the literal substring ' src=' and an event-handler attribute while containing no HTML tags or quote characters - so it passes WordPress core's sanitize_text_field intact and is then broken out of the alt attribute by the plugin's str_replace. Limiting factors: comments (and author-name rendering) must be enabled; comment moderation or spam filtering can block the malicious comment before publication; and the script only fires when a victim actually loads the page containing the injected image markup.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C) scores 7.2 and paints a serious picture: network-reachable, low-complexity, unauthenticated, with a scope change reflecting that the injected script executes in the browser of a different security context (any site visitor, including logged-in administrators). However, no EPSS score, no CISA KEV listing, and no public exploit were supplied in the intelligence, so there is no evidence of active or imminent widespread exploitation - the real-world urgency signals are absent or unknown. The practical exploitation barrier is also higher than the AC:L metric implies: the description details a very specific bypass chain (an author Name value with ' src=' plus an event handler, free of HTML tags and quote characters, surviving sanitize_text_field and then having a single quote injected by the plugin's own str_replace), and it depends on the site accepting comments and rendering the optimized image markup. Net assessment: a legitimate stored-XSS flaw worth prioritizing for patching because it is unauthenticated and affects admin sessions, but given no KEV/POC/EPSS evidence and a constrained payload path, it is a 'patch promptly' issue rather than an emergency. Note the apparent tension to verify: UI:N is asserted even though execution occurs 'whenever a user accesses an injected page,' which is victim-driven page access - confirm whether UI:N vs UI:R is appropriate with the vendor.

An unauthenticated attacker submits a comment to a WordPress site running 10Web Booster, placing a crafted payload (containing ' src=' and an event-handler attribute, with no HTML tags or quotes) in the comment author Name field. The value survives WordPress's sanitize_text_field and lands verbatim inside an image alt attribute, where the plugin's str_replace injects a single quote that breaks out of the attribute, so the script executes in the browser of anyone - including administrators - who later views the affected page. No public exploit code was identified at time of analysis.