CVE-2026-17532
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Seraphinite Accelerator plugin for WordPress up to version 2.29.15 is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter. The CacheExtractPreparePageParams() function uses loose comparison (!=) for HMAC verification, allowing bypass, and insufficient output escaping in _CbContentFinishSkip() enables script injection. The attack requires user interaction, such as clicking a crafted link.
Risk Assessment
An attacker can execute arbitrary scripts in the victim's browser, potentially leading to session theft, account takeover, or malware distribution.
Recommendation
Update the Seraphinite Accelerator plugin to the latest patched version. Educate users to avoid clicking suspicious links.
Other vulnerabilities in Seraphinite Accelerator
See all- CVE-2026-90960Medium
The Seraphinite Accelerator plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to 2.29.24 via WP_Object_Cache::_getFilePath. Unauthenticated attackers can extract complete WordPress user records — including plaintext user_login, user_email, hashed user_pass, and user_activation_key — from predictable gzip-serialized cache files at wp-content/cache/seraphinite-accelerator/oc/g/users/g/<USER_ID>.dat.gz. This vulnerability is only exploitable when the plugin's Object Cache feature is enabled, and requires the attacker to first trigger caching of the target user record (e.g., via an unauthenticated REST API request) before retrieving the resulting cache file.
- CVE-2026-87828Medium
The Seraphinite Accelerator WordPress plugin before 2.29.24 does not perform a capability check on one of its state-update AJAX actions. Authenticated users such as subscribers can write a malformed value that causes an uncaught error on every subsequent admin page load, making the entire admin area inaccessible to all administrators (denial of service).
Original NVD description (English source)
The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams() function using PHP's loose inequality operator (!=) to compare the expected HMAC string against the JSON-decoded 'nonce' value — supplying the JSON boolean true causes any non-empty HMAC string to compare as loosely equal, bypassing the signature check — combined with insufficient output escaping in the _CbContentFinishSkip() function, which concatenates the attacker-controlled 'selfTest' field directly into the HTML response body. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS