CVE-2026-96578

Name of the Vulnerable Software and Affected Versions GSpeech TTS – WordPress Text To Speech Plugin versions prior to 3.22.1

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting via comment content. This is achieved through an mXSS-style transform, where the payload is stored using tags and attributes allowed by WordPress comment kses sanitization. The malicious event handlers and style fragments are activated when the plugin's output-buffer callback rewrites the rendered HTML during the request. This allows the execution of arbitrary web scripts whenever a user accesses the affected page.

Recommendations Update GSpeech TTS – WordPress Text To Speech Plugin to version 3.22.1 or later.