CVE-2026-115951: WordPress Lazy Load for Videos plugin <= 2.18.11 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Weber Lazy Load for Videos lazy-load-for-videos allows Stored XSS.This issue affects Lazy Load for Videos: from n/a through 2.18.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
lazy-load-for-videosto a version that resolves this vulnerability.Fixed in 2.18.12
Event History
Frequently Asked Questions
What level of access and interaction are required to exploit this issue?
The vector indicates network-reachable exploitation with low attack complexity, but the attacker needs low-level privileges and a user must interact with the injected content. Successful exploitation can affect confidentiality, integrity, and availability across a changed security scope.
Which plugin versions are affected?
Lazy Load for Videos versions through 2.18.11 are affected. The available data does not identify a fixed version.
What is the likely impact if exploitation succeeds?
This is a stored XSS issue, meaning attacker-supplied script can be retained and later executed when another user views the affected page or content. The supplied metrics rate confidentiality, integrity, and availability impact as low.