{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3awp-flying-scriptsflying_scriptswordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:wp-flying-scripts:flying_scripts:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-109990"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Flying Scripts: Delay JavaScript to Improve Site Speed \u0026 Performance (\u003c= 1.2.4)"],"_cs_severities":["high"],"_cs_tags":["web-application","xss","wordpress","cve-2026-109990"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Flying Scripts: Delay JavaScript to Improve Site Speed \u0026amp; Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.2.4. This vulnerability arises due to insufficient input sanitization and output escaping within the plugin's core logic.\u003c/p\u003e\n\u003cp\u003eThe exploit mechanism is unique because it effectively bypasses WordPress core's save-time 'kses' sanitization. Attackers utilize payloads consisting of elements allowed by the core sanitizer, specifically the 'abbr' tag with a 'title' attribute and 'code' text content. The vulnerability is triggered post-save by the plugin's output-buffer rewriter. This component substitutes content into the 'abbr title' attribute using predictable, unsalted placeholders. By crafting a payload that conforms to allowed tags during the initial submission but incorporates double-quote-bearing 'code' blocks during output substitution, an unauthenticated attacker can achieve arbitrary JavaScript execution in the browser of any user who accesses the compromised page. This vulnerability poses a significant risk to site administrators and users, potentially leading to session hijacking, site defacement, or credential theft.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated remote attackers to execute arbitrary JavaScript in the context of a victim's browser session. This can be used to perform actions on behalf of the user, steal session cookies, or redirect visitors to malicious sites. Given that this vulnerability exists in a popular performance plugin, any WordPress site running version 1.2.4 or lower is at risk of complete compromise of the visitor-facing side of their web application.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eImmediately update the 'Flying Scripts: Delay JavaScript to Improve Site Speed \u0026amp; Performance' plugin to the latest version, ensuring the patch for CVE-2026-109990 is applied.\u003c/li\u003e\n\u003cli\u003eAudit WordPress comment sections for unexpected 'abbr' tags with unusual 'title' attributes, as these are primary indicators of the malicious payload injection.\u003c/li\u003e\n\u003cli\u003eReview web server logs for suspicious POST requests targeting comment submission endpoints that contain HTML tags or encoded characters.\u003c/li\u003e\n\u003cli\u003eImplement a robust Content Security Policy (CSP) to restrict the execution of unauthorized inline scripts, which provides a layer of defense-in-depth against stored XSS vulnerabilities.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-16T04:24:23Z","date_published":"2026-10-16T04:24:23Z","id":"https://feed.craftedsignal.io/briefs/2026-10-flying-scripts-xss/","summary":"An unauthenticated stored XSS vulnerability in the Flying Scripts WordPress plugin (CVE-2026-109990) allows attackers to execute arbitrary JavaScript by bypassing core sanitization through an output-buffer rewriter.","title":"Stored Cross-Site Scripting in Flying Scripts WordPress Plugin","url":"https://feed.craftedsignal.io/briefs/2026-10-flying-scripts-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:wp-Flying-Scripts:flying_scripts:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}