CVE-2026-100196

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.4.0 . The root cause is insufficient input sanitization and output escaping within the comment_content parameter. Attackers can bypass Wor...

CVE-2026-100196 LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentcontent rendered inline into the page HTML' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escapin...

EUVD-2026-96211

The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'commentcontent rendered inline into the page HTML' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escapin...

WordPress LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by theviper17y in WordPress Plugin Rocket Lazy Load versions = 2.4.0...