Xspeed Cache
Monthly
Stored cross-site scripting in the xSpeed Cache WordPress plugin through version 1.4.2 allows authenticated users with contributor-level access or higher to inject arbitrary web scripts through the 'content' parameter, which then execute when another user views the affected page. The flaw stems from insufficient input sanitization and output escaping in the lazy-loading code path and is rated CVSS 6.4 with PR:L and S:C. No public exploit code was identified at time of analysis, and exposure is concentrated on multi-author or open-registration sites where an attacker can obtain a contributor account.
Stored cross-site scripting in the xSpeed Cache WordPress plugin through version 1.4.2 allows authenticated users with contributor-level access or higher to inject arbitrary web scripts through the 'content' parameter, which then execute when another user views the affected page. The flaw stems from insufficient input sanitization and output escaping in the lazy-loading code path and is rated CVSS 6.4 with PR:L and S:C. No public exploit code was identified at time of analysis, and exposure is concentrated on multi-author or open-registration sites where an attacker can obtain a contributor account.