CVE-2026-6427

Name of the Vulnerable Software and Affected Versions a3 Lazy Load versions prior to 2.7.7

Description The plugin contains a Stored Cross-Site Scripting issue caused by a regex bug in the filter videos() method and unescaped output in the admin/views/form-data.php template. An authenticated attacker with Contributor-level access can insert a crafted <video> tag with a src attribute containing a class=" substring. This tricks the class-replacement regex into consuming an attribute-value closing quote, shifting the HTML5 parser's quote boundary and allowing attacker-controlled text to be executed as standalone event-handler attributes, such as autofocus and onfocus. The injected script then executes in the browser of any user, including administrators, who views the post.

Recommendations Update to a version newer than 2.7.6.