Executive brief
The a3 Lazy Load plugin for WordPress, which is used to speed up websites by delaying the loading of images and videos, contains a security flaw. This vulnerability allows an attacker with basic contributor access to inject malicious scripts into website posts. These scripts automatically run in the browser of any visitor, including site administrators, potentially leading to unauthorized actions or site takeover.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the a3 Lazy Load plugin due to a regex flaw in the _filter_videos() method and unescaped output in the admin/views/form-data.php template. An authenticated attacker with Contributor-level permissions can submit a crafted <video> tag containing a specific 'class=' substring within the src attribute. This tricks the plugin's regex into mismanaging HTML attribute quotes, allowing the attacker to inject event handlers like 'onfocus' or 'autofocus'. The resulting script executes when any user views the affected post. The issue is resolved in version 2.7.7.
Affected products
- a3rev Software a3 Lazy Load up to, and including, 2.7.6
Timeline
- 2026-05-28: advisory: Initial disclosure by Wordfence and NVD
References
- https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/admin/views/form-data.php
- https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/classes/class-a3-lazy-load.php
- https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/classes/class-a3-lazy-load.php
- https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/classes/class-a3-lazy-load.php
- https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/classes/class-a3-lazy-load.php
- https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/classes/class-a3-lazy-load.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fa3-lazy-load/tags/2.7.6&new_path=%2Fa3-lazy-load/tags/2.7.7