CVE-2026-6427

The a3 Lazy Load plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.7.6 This is due to a regex bug in the _filter_videos() method that breaks HTML attribute quoting when processing crafted

More information : https://plugins.trac.wordpress.org/browser/a3-lazy-load/trunk/admin/views/form-data.php#L11