Is CVE-2026-107742 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-107742 being exploited in the wild.

How severe is CVE-2026-107742?

High severity, with a CVSS score of 7.2, published 10 October 2026.

Which products and versions are affected?

10Web Booster up to and including 2.34.8.

Is there a fix for CVE-2026-107742?

Yes: fixed in 2.34.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-107742 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-107742?

Check whether you run 10Web Booster at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-107742: 10Web Booster stored cross-site scripting in author parameter

CVE-2026-107742 · Severity: high · CVSS 7.2 · Published 2026-10-10

10Web Booster is a WordPress plugin that optimizes website speed and caching. A flaw in how the plugin processes comment author names allows unauthenticated attackers to inject malicious scripts that execute in the browsers of anyone viewing affected pages, potentially stealing credentials or redirecting users to malicious sites.

Technologies: 10Web Booster. Vendors: 10Web.

Quick answers

Is CVE-2026-107742 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-107742 being exploited in the wild.
How severe is CVE-2026-107742?: High severity, with a CVSS score of 7.2, published 10 October 2026.
Which products and versions are affected?: 10Web Booster up to and including 2.34.8.
Is there a fix for CVE-2026-107742?: Yes: fixed in 2.34.10. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-107742 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-107742?: Check whether you run 10Web Booster at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2.34.10

Technical details

The plugin fails to properly sanitize and escape the comment author name parameter, allowing stored cross-site scripting (XSS). Specifically, a payload containing 'src=' and an event handler bypasses WordPress's sanitize_text_field and the plugin's str_replace validation, ultimately breaking out of an HTML alt attribute context. Unauthenticated attackers can exploit this by crafting malicious comment author names.

Affected products

10Web Booster up to and including 2.34.8

Timeline

2026-10-10: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.