Stored XSS in 10Web Booster WordPress Plugin (CVE-2026-107742)

The 10Web Booster - Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is affected by a critical Stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-107742. This flaw exists in all versions up to and including 2.34.8. It stems from insufficient input sanitization and output escaping within the 'author' parameter used in comment processing. Unauthenticated attackers can inject malicious JavaScript payloads that bypass WordPress core's 'sanitize_text_field' function. The payload is successfully stored when it arrives verbatim within an 'alt' attribute, at which point the plugin's internal 'str_replace' function injects a single quote that breaks the attribute context, enabling the execution of arbitrary scripts in the browsers of users who view the affected pages. This vulnerability could lead to session hijacking, site defacement, or administrative account takeover if an administrator views the injected comment.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an end-user's session. This poses a significant risk to site administrators, as it could facilitate the theft of session cookies, perform unauthorized actions on behalf of the administrator, or redirect users to malicious sites, potentially leading to a full site compromise.

Recommendation

Prioritized actions for security and IT teams to mitigate CVE-2026-107742:

• Update the 10Web Booster plugin to the latest available version (beyond 2.34.8) immediately.
• Audit WordPress comment sections for anomalous entries containing suspicious attributes or event handlers (e.g., 'onmouseover', 'onerror').
• Deploy a Web Application Firewall (WAF) rule to inspect and block incoming HTTP POST requests containing common XSS vectors (e.g., event handlers or attribute breakout attempts) directed at WordPress comment submission endpoints.