CVE-2026-96572Published
WP Meteor Website Speed Optimization Addon <= 3.4.18 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-96572 · Microsoft / collected KEV context
cve-program · CVE-2026-96572
- https://www.wordfence.com/threat-intel/vulnerabilities/id/f54e358c-3bdf-426a-854a-d1bc8ff19afd?source=cve
- https://plugins.trac.wordpress.org/browser/wp-meteor/tags/3.4.18/blocker/FirstInteraction/UltimateReorder.php#L178
- https://plugins.trac.wordpress.org/browser/wp-meteor/tags/3.4.18/blocker/FirstInteraction/UltimateReorder.php#L169
- https://plugins.trac.wordpress.org/browser/wp-meteor/tags/3.4.18/frontend/Rewrite.php#L93
- https://plugins.trac.wordpress.org/browser/wp-meteor/tags/3.4.18/frontend/Rewrite.php#L41
- https://plugins.trac.wordpress.org/changeset/3726637
- https://plugins.trac.wordpress.org/changeset/3726637/wp-meteor/trunk/blocker/FirstInteraction/UltimateReorder.php
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.