CVE-2026-100196

Name of the Vulnerable Software and Affected Versions LazyLoad Plugin – Lazy Load Images, Videos, and Iframes versions prior to 2.4.1

Description Stored Cross-Site Scripting occurs via the comment content parameter, which is rendered inline into the page HTML. This issue stems from insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user accesses the affected page. The vulnerability bypasses the WordPress core wp kses data allow-list because the payload uses permitted tags and attributes, hiding the event handler within a broken attribute region. The plugin's render-time str replace() function then promotes this to a real DOM attribute. Execution of the payload requires a site administrator to approve the crafted comment.

Recommendations Update to a version newer than 2.4.0. As a temporary workaround, restrict the ability for unauthenticated users to submit comments or ensure strict manual review of all comment content before approval.