CVE-2026-118784 in WPSpeed Plugin
Summary
by MITRE • 11/07/2026
The WPSpeed plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.6.10 This is due to a combination of two issues in the LightImages HTML optimizer: (1) Dispatcher::runOptimize() decides whether the current request is the site's home page by comparing only the URL path from REQUEST_URI against the path of the home URL, so on a plain-permalinks install the author archive URL /?author=<ID> is treated as the home page and the LightImages optimizer runs on it; and (2) LightImages::optimize() calls html_entity_decode() across the entire serialized DOMDocument output under the default-enabled img_processing_entity_decode setting, converting any entity-encoded markup present as plain text in the page (including WordPress's rendered author title) into live HTML. This makes it possible for authenticated attackers, with Subscriber-level access and above, to store entity-encoded markup in their own nickname/display_name through the normal profile endpoint and have that markup rehydrated into executing script when any logged-out visitor loads their author archive.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/07/2026
The WPSpeed plugin for WordPress versions up to 2.6.10 contains a critical Stored Cross-Site Scripting vulnerability rooted in the interaction between its URL routing logic and HTML optimization features. The core technical flaw arises from two distinct issues within the LightImages HTML optimizer component. First, the Dispatcher::runOptimize() function determines whether the current request corresponds to the site's home page by comparing only the URL path extracted from REQUEST_URI against the path of the configured home URL. This simplistic comparison fails on installations using plain permalinks, where query parameters are retained in the URI structure rather than being rewritten into clean paths. Consequently, URLs such as /?author=<ID>, which represent author archive pages, are incorrectly identified and processed as if they were the static home page, triggering optimization routines that should not apply to dynamic content endpoints.
Second, within this misidentified context, the LightImages::optimize() function executes html_entity_decode() across the entire serialized DOMDocument output when the img_processing_entity_decode setting is enabled by default. This operation converts any entity-encoded markup present in the page source into live HTML elements. Since WordPress renders author display names and nicknames as part of the page content on these archive pages, an attacker can exploit this behavior by injecting malicious script tags encoded as HTML entities into their own profile information via the standard user profile endpoint. When a logged-out visitor subsequently loads the attacker's author archive page, the optimization process decodes these entities, effectively rehydrating the stored scripts and causing them to execute in the context of the victim's browser session.
This vulnerability allows authenticated attackers with Subscriber-level access or higher to perform persistent cross-site scripting attacks against unauthenticated users. The operational impact is significant as it enables the theft of sensitive information such as cookies, session tokens, or authentication credentials belonging to site visitors who view the compromised author page. Furthermore, this attack vector can be leveraged for phishing campaigns, defacement, or further exploitation by redirecting victims to malicious sites. From a classification perspective, this flaw aligns with CWE-79 Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting and maps to the ATT&CK technique T1059 Command and Scripting Interpreter for executing arbitrary code within the victim's environment through browser-based scripts.
Mitigation strategies should prioritize immediate updates to WPSpeed version 2.6.11 or later, where these logical flaws in URL comparison and entity decoding have been addressed. Administrators unable to update immediately should disable the img_processing_entity_decode setting if it is enabled, thereby preventing the conversion of encoded entities into executable HTML during optimization. Additionally, implementing strict input validation and output encoding for user-generated content such as display names can provide an additional layer of defense against stored XSS attacks regardless of plugin configuration states. Regular security audits focusing on how plugins handle dynamic URL structures and entity decoding are essential to prevent similar logic errors in future updates or related software components.