Stored Cross-Site Scripting in Flying Scripts WordPress Plugin

The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.2.4. This vulnerability arises due to insufficient input sanitization and output escaping within the plugin's core logic.

The exploit mechanism is unique because it effectively bypasses WordPress core's save-time 'kses' sanitization. Attackers utilize payloads consisting of elements allowed by the core sanitizer, specifically the 'abbr' tag with a 'title' attribute and 'code' text content. The vulnerability is triggered post-save by the plugin's output-buffer rewriter. This component substitutes content into the 'abbr title' attribute using predictable, unsalted placeholders. By crafting a payload that conforms to allowed tags during the initial submission but incorporates double-quote-bearing 'code' blocks during output substitution, an unauthenticated attacker can achieve arbitrary JavaScript execution in the browser of any user who accesses the compromised page. This vulnerability poses a significant risk to site administrators and users, potentially leading to session hijacking, site defacement, or credential theft.

Impact

Successful exploitation allows unauthenticated remote attackers to execute arbitrary JavaScript in the context of a victim's browser session. This can be used to perform actions on behalf of the user, steal session cookies, or redirect visitors to malicious sites. Given that this vulnerability exists in a popular performance plugin, any WordPress site running version 1.2.4 or lower is at risk of complete compromise of the visitor-facing side of their web application.

Recommendation

• Immediately update the 'Flying Scripts: Delay JavaScript to Improve Site Speed & Performance' plugin to the latest version, ensuring the patch for CVE-2026-109990 is applied.
• Audit WordPress comment sections for unexpected 'abbr' tags with unusual 'title' attributes, as these are primary indicators of the malicious payload injection.
• Review web server logs for suspicious POST requests targeting comment submission endpoints that contain HTML tags or encoded characters.
• Implement a robust Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts, which provides a layer of defense-in-depth against stored XSS vulnerabilities.