CVE-2026-109990: Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

Q: Does an attacker need a WordPress account or elevated privileges?

No. The issue can be exploited by an unauthenticated attacker through the affected comment parameter.

Q: Will WordPress core's normal save-time KSES filtering block the payload?

No. The payload uses KSES-allowed elements and is transformed into XSS after saving by the plugin's output-buffer rewriter, bypassing save-time KSES sanitization.

Q: When would a malicious payload execute?

The injected script executes when a user accesses a page containing the injected content. The vulnerability can affect every Flying Scripts version through 1.2.4, inclusive.

Published Oct 16, 2026

Updated

The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an <abbr title> attribute and <code> text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing <code> body into the <abbr title> attribute via predictable, unsalted noise placeholder keys.

Affected Software

1 affected component

Flying Scripts Delay JavaScript to Improve Site Speed & Performance<=1.2.4

Event History

Oct 16, 2026

CVE Published

via MITRE·03:38 AM

Data Sourced

via MITRE·03:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Does an attacker need a WordPress account or elevated privileges?

No. The issue can be exploited by an unauthenticated attacker through the affected comment parameter.

Will WordPress core's normal save-time KSES filtering block the payload?

No. The payload uses KSES-allowed elements and is transformed into XSS after saving by the plugin's output-buffer rewriter, bypassing save-time KSES sanitization.

When would a malicious payload execute?

The injected script executes when a user accesses a page containing the injected content. The vulnerability can affect every Flying Scripts version through 1.2.4, inclusive.

CVE-2026-109990: Flying Scripts: Delay JavaScript to Improve Site Speed & Performance <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting via Comment Content

Affected Software

Event History

Frequently Asked Questions

Does an attacker need a WordPress account or elevated privileges?

Will WordPress core's normal save-time KSES filtering block the payload?

When would a malicious payload execute?

Company

Resources

Contact

Frequently Asked Questions

Does an attacker need a WordPress account or elevated privileges?

Will WordPress core's normal save-time KSES filtering block the payload?

When would a malicious payload execute?