{"affected":[{"defaultStatus":"unaffected","product":"WPSpeed – WordPress Speed, Cache & Performance Optimization (Core Web Vitals, PageSpeed 100)","source":"CNA: Wordfence","vendor":"john-dagelmore","versions":[{"lessThanOrEqual":"2.6.10","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-118784","cwes":["CWE-79"],"description":"The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a combination of two issues in the LightImages HTML optimizer: (1) Dispatcher::runOptimize() decides whether the current request is the site's home page by comparing only the URL path from REQUEST_URI against the path of the home URL, so on a plain-permalinks install the author archive URL /?author=<ID> is treated as the home page and the LightImages optimizer runs on it; and (2) LightImages::optimize() calls html_entity_decode() across the entire serialized DOMDocument output under the default-enabled img_processing_entity_decode setting, converting any entity-encoded markup present as plain text in the page (including WordPress's rendered author title) into live HTML. This makes it possible for authenticated attackers, with Subscriber-level access and above, to store entity-encoded markup in their own nickname/display_name through the normal profile endpoint and have that markup rehydrated into executing script when any logged-out visitor loads their author archive.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":6.4,"severity":"medium","source":"CNA: Wordfence","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},{"score":6.4,"severity":"medium","source":"NVD: security@wordfence.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"}],"modifiedAt":1794046627107,"publishedAt":1794043546871,"references":[{"source":"CNA: Wordfence","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47aa1a74-4189-4521-ba6e-e91a06b8f5a6?source=cve"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wpspeed/tags/2.6.10/src/Dispatcher.php#L170"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wpspeed/tags/2.6.10/src/Core/LightImages.php#L628"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wpspeed/tags/2.6.10/src/Core/Optimize.php#L152"},{"source":"CNA: Wordfence","tags":[],"url":"https://plugins.trac.wordpress.org/changeset/3771695/wpspeed/trunk/src/Core/LightImages.php"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wpspeed/tags/2.6.10/src/Core/LightImages.php#L628"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wpspeed/tags/2.6.10/src/Core/Optimize.php#L152"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/browser/wpspeed/tags/2.6.10/src/Dispatcher.php#L170"},{"source":"security@wordfence.com","tags":[],"url":"https://plugins.trac.wordpress.org/changeset/3771695/wpspeed/trunk/src/Core/LightImages.php"},{"source":"security@wordfence.com","tags":[],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/47aa1a74-4189-4521-ba6e-e91a06b8f5a6?source=cve"}],"remediation":[],"revision":"67ae0250be28f19db0d001a7262ad28b56ca5d7d863d879632b39783d542a4a5","sources":[{"modifiedAt":1794043546871,"name":"CNA: Wordfence","retrievedAt":1794046103652,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118784"},{"modifiedAt":1794046627107,"name":"NVD","retrievedAt":1794053769785,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118784"}],"ssvc":null,"status":"published","title":"WPSpeed <= 2.6.10 - Authenticated (Subscriber+) Stored Cross-Site Scripting via User Nickname/Display Name","updatedAt":1794053769785}