CVE-2026-107742

Name of the Vulnerable Software and Affected Versions 10Web Booster – Website speed optimization, Cache & Page Speed optimizer versions prior to 2.34.9

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. The issue is triggered via the author parameter, where a comment author name containing src= and an event-handler payload can bypass the sanitize text field function. The plugin's str replace() function then injects a single quote that allows the payload to break out of the attribute context within the alt attribute.

Recommendations Update 10Web Booster – Website speed optimization, Cache & Page Speed optimizer to version 2.34.9 or later.