CVE-2026-96578

Overview

The GSpeech TTS WordPress plugin (v3.22.0 and earlier) is vulnerable to stored XSS via comment content, allowing unauthenticated attackers to inject scripts that execute on page load. The flaw bypasses WordPress sanitization by using allowed tags and attributes, enabling malicious payloads to run when the plugin rewrites HTML. This can lead to session hijacking, defacement, or data theft.

Description

The GSpeech TTS – WordPress Text To Speech Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 3.22.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This mXSS-style transform bypasses WordPress comment kses sanitization because the payload is stored using only kses-allowed tags and attributes; the malicious event handlers and style fragments become active only when the plugin's output-buffer callback rewrites the rendered HTML at request time.

Impact

Confidentiality: attackers can steal session cookies or sensitive data. Integrity: malicious scripts can alter page content or redirect users. Availability: repeated injection could degrade site performance. Site owners, administrators, and visitors are impacted.

Remediation

Update the plugin to the latest version (>=3.23.0) or disable it if not needed. As a temporary measure, block comment submissions from unauthenticated users or apply stricter CSP headers (e.g., script-src 'self'). Ensure WordPress core and other plugins are up to date to avoid similar sanitization bypasses.

Risk context

Severity is high with CVSS 7.2 and a low EPSS of 0.0025, indicating a moderate likelihood but significant impact if exploited. Defenders should prioritize patching or disabling the plugin to mitigate potential attacks.

Affected products

• GSpeech TTS WordPress Plugin