CVE-2026-96572

Name of the Vulnerable Software and Affected Versions WP Meteor Website Speed Optimization Addon versions prior to 3.4.19

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs when a payload is delivered through the comment author name field. These scripts execute whenever a user accesses the affected page, provided the comment has passed the WordPress moderation workflow.

Recommendations Update WP Meteor Website Speed Optimization Addon to version 3.4.19 or later.