Lazyload Plugin Lazy Load Images Videos And Iframes
Monthly
Stored cross-site scripting in the WordPress plugin LazyLoad Plugin - Lazy Load Images, Videos, and Iframes (rocket-lazy-load) through version 2.4.0 allows unauthenticated commenters to embed a crafted payload in a comment body that survives WordPress's wp_kses_data sanitization and only becomes an executable event handler when the plugin's render-time markup rewriting runs. Any visitor who subsequently loads the affected page can have arbitrary JavaScript executed in their browser, though exploitation is partly constrained because a site administrator must approve the crafted comment before it is rendered to others. There is no confirmed active exploitation (no CISA KEV) and no public exploit code identified at time of analysis; the CVSS 3.1 base score is 7.2 and our assessment adjusts the user-interaction metric to Required (UI:R) to reflect the moderation approval step. The vendor has released a fixed version (2.4.1).
Stored cross-site scripting in the WordPress plugin LazyLoad Plugin - Lazy Load Images, Videos, and Iframes (rocket-lazy-load) through version 2.4.0 allows unauthenticated commenters to embed a crafted payload in a comment body that survives WordPress's wp_kses_data sanitization and only becomes an executable event handler when the plugin's render-time markup rewriting runs. Any visitor who subsequently loads the affected page can have arbitrary JavaScript executed in their browser, though exploitation is partly constrained because a site administrator must approve the crafted comment before it is rendered to others. There is no confirmed active exploitation (no CISA KEV) and no public exploit code identified at time of analysis; the CVSS 3.1 base score is 7.2 and our assessment adjusts the user-interaction metric to Required (UI:R) to reflect the moderation approval step. The vendor has released a fixed version (2.4.1).