Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting

The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraphaccelprep parameter. CacheExtractPreparePageParams compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON...

CVE-2026-17532-lab

CVE-2026-17532 实验室 - Seraphinite Accelerator：未认证 XSS → 一键 RCE 一个针对 CVE-2026-17532 的 Docker 实验室，该漏洞是 WordPress 插件 Seraphinite Accelerator 中的一个未认证反射型 XSS，当登录的管理员打开一个精心构造的链接时，可链式利用实现远程代码执行。 完整文章 ：博客 环境要求 安装了 Compose 插件的 Docker 宿主机上的 python3 或 php（仅用于构建漏洞利用 URL - exploit.sh 会使用其中任意一个） 运行 docker compo...

CVE-2026-17532

Seraphinite Accelerator としてエコーバックされます。 認証不要の単一URL: http://TARGET/?seraphaccelprep=alertdocument.domain" 使用方法 Python（pip install requests が必要）: usage: seraphaccelxss.py -h --url URL --payload PAYLOAD --timeout TIMEOUT Seraphinite Accelerator WordPress alertdocument.domain --timeout TIMEOUT seconds...

WordPress Seraphinite Accelerator plugin < 2.29.24 - Subscriber+ DoS vulnerability

Subscriber+ DoS vulnerability discovered by Ángel PS drtz in WordPress Plugin Seraphinite Accelerator versions 2.29.24...

CVE-2026-87828

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

CVE-2026-87828 Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

CVE-2026-87828

The Seraphinite Accelerator WordPress plugin (versions before 2.29.24 ) is vulnerable to a denial of service (DoS) attack due to a missing capability check on a state-update AJAX action. This flaw allows authenticated users, such as subscribers , to submit a malformed value that triggers an uncau...

CVE-2026-87828 Seraphinite Accelerator < 2.29.24 - Subscriber+ DoS via seraph_accel_State Update

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

EUVD-2026-80207

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

CVE-2026-87828: Uncontrolled Resource Consumption

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

PT-2026-93308

The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions, allowing authenticated users such as subscribers to write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire...

WordPress Seraphinite Accelerator plugin <= 2.29.18 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Alireza in WordPress Plugin Seraphinite Accelerator versions = 2.29.18...

CVE-2026-17532

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

CVE-2026-17532 Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

CVE-2026-17532 Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

EUVD-2026-53175

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

CVE-2026-17532

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

Exploit for CVE-2026-17532

CVE-2026-17532 S...

CVE-2026-17532: Improper Neutralization of Input During Web Page Generation

The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraphaccelprep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams function using PHP's loose inequality operator != to compare the expecte...

PT-2026-68017

Name of the Vulnerable Software and Affected Versions Seraphinite Accelerator versions prior to 2.29.16 Description Unauthenticated attackers can inject arbitrary web scripts into pages by tricking a user into clicking a specially crafted link. This occurs via the 'seraph accel prep' parameter. T...