/Vulnerability Library

Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting

CVE-2026-17532
Verified

Description

The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraph_accel_prep parameter. CacheExtractPreparePageParams() compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON boolean true satisfied the comparison and bypassed the signature check, and _CbContentFinishSkip() then concatenated the attacker-controlled selfTest field straight into the response body, letting unauthenticated attackers inject arbitrary scripts.

Severity

Medium

CVSS Score

6.1

Exploit Probability

1%

Affected Product

seraphinite-accelerator

Published Date

August 6, 2026

Template Author

0x_akoko

CVE-2026-17532.yaml
6.1Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVE ID:
cve-2026-17532
CWE ID:
cwe-79

References

https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/seraphinite-accelerator/seraphinite-accelerator-22918-reflected-cross-site-scriptinghttps://plugins.trac.wordpress.org/browser/seraphinite-accelerator/trunk/common.phphttps://nvd.nist.gov/vuln/detail/CVE-2026-17532

Remediation Steps

Update Seraphinite Accelerator to version 2.29.19 or later.