CVE-2026-107742 in Booster Plugin
Summary
by MITRE • 10/10/2026
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is exploitable because a comment author Name value containing ' src=' and an event-handler payload contains no HTML tags or quote characters, allowing it to survive WordPress core's sanitize_text_field and land verbatim inside the alt attribute, where the plugin's own str_replace subsequently injects the single quote that breaks out of the attribute context.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The 10Web Booster plugin for WordPress, a widely used tool designed for website speed optimization through caching and page speed enhancements, contains a critical security flaw in versions up to and including 2.34.8. This vulnerability is classified as a Stored Cross-Site Scripting issue, which represents a severe risk because the malicious payload persists on the server rather than being transiently passed via URL parameters or headers. The root cause lies in insufficient input sanitization and output escaping mechanisms within the plugin's handling of user-generated content, specifically targeting the author parameter associated with comments posted on WordPress sites running this software.
The technical mechanism of exploitation relies on a specific bypass technique that circumvents standard WordPress security functions. Attackers can inject arbitrary web scripts by crafting a comment where the author name field contains a payload consisting of src= followed by an event-handler, without including any HTML tags or quote characters. This structure is significant because it allows the malicious string to survive the execution of WordPress core's sanitize_text_field function, which typically strips out dangerous elements but fails to detect this specific pattern due to its lack of quotes and standard tag structures. Consequently, the payload remains intact as raw text within the database entry.
The actual code injection occurs during the rendering phase when the plugin processes the stored data for display. The 10Web Booster plugin employs a str_replace operation that inadvertently injects a single quote character into the output context. This injected quote breaks out of the surrounding HTML attribute context, specifically the alt attribute where the author name is being rendered. Once the attribute boundary is broken, the browser interprets the subsequent content as executable JavaScript code rather than static text. When any user visits a page containing this compromised comment, their browser executes the injected script in the context of the vulnerable site, leading to session hijacking, defacement, or further malware distribution depending on the payload's intent.
From an operational impact perspective, this vulnerability allows unauthenticated attackers to compromise the integrity and confidentiality of WordPress sites utilizing the affected plugin version. Since no authentication is required to post comments on most public-facing WordPress installations, the attack surface is broad and easily accessible. The persistent nature of stored XSS means that every visitor to the infected page becomes a potential victim, amplifying the impact beyond just the initial attacker. This can lead to significant reputational damage for site owners, loss of user trust, and potential compliance violations if sensitive data is exfiltrated through cookie theft or session fixation attacks facilitated by the script execution.
In terms of industry standards, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific technique of breaking out of an attribute context via injected quotes is a classic manifestation of this weakness. Furthermore, from the perspective of the MITRE ATT&CK framework, this exploit falls under T1059, Command and Scripting Interpreter, specifically within the subcategory for JavaScript execution in web browsers. It also relates to TA0003 Persistence if the attacker uses the stored script to maintain access or modify site configurations over time.
Mitigation strategies must focus on immediate remediation of the vulnerable code paths. Site administrators should update the 10Web Booster plugin to a version newer than 2.34.8, where these input sanitization and output escaping issues have been addressed by the developers. Until an official patch is applied or available, temporary mitigations may include implementing Web Application Firewall rules that detect and block payloads containing src= followed immediately by event handlers in comment author fields. Additionally, enabling Content Security Policy headers can help mitigate the impact of any successful XSS attempts by restricting the sources from which scripts are allowed to execute, thereby reducing the effectiveness of injected code even if it manages to bypass input filters.