CVE-2026-109990

7.2High

Published 16 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

7.2High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-79

Impact

Unauthenticated attackers can inject persistent malicious scripts into comment sections that execute in victims' browsers when viewing infected pages. Attackers only need network access to post a comment containing the crafted payload.

Root cause

The plugin's output-buffer rewriter injects unescaped quotes into HTML attributes during post-save processing via predictable placeholder substitutions.

Affected systems

Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress through version 1.2.4

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Fix & remediation

Upgrade Flying Scripts to a version newer than 1.2.4 if available, or deactivate and delete the plugin immediately until a patched version is installed.

shell

$ wp plugin deactivate flying-scripts

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Flying Scripts: Delay JavaScript to Improve Site Speed & Performance plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit bypasses WordPress core's save-time kses sanitization entirely because the payload uses only kses-allowed elements — an <abbr title> attribute and <code> text content — and the XSS is introduced post-save when the plugin's output-buffer rewriter substitutes a double-quote-bearing <code> body into the <abbr title> attribute via predictable, unsalted ___noise___ placeholder keys.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-109990