CVE-2026-6427

Description

The a3 Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.7.6 This is due to a regex bug in the _filter_videos() method that breaks HTML attribute quoting when processing crafted

Affected Platforms

Weakness Type

CWE-79

References

• https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/admin/views/form-d…
• https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/classes/class-a3-l…
• https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/classes/class-a3-l…
• https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/classes/class-a3-l…
• https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/classes/class-a3-l…
• https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/classes/class-a3-l…