CVE-2026-17532 Seraphinite Accelerator <= 2.29.18 - Reflected Cross-Site Scripting
Unauthenticated attackers can inject arbitrary web scripts via a crafted link due to HMAC bypass and insufficient output escaping in the Seraphinite Accelerator plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-17532?
CVE-2026-17532 is a medium-severity cross-site scripting vulnerability in seraphinitesoft Seraphinite Accelerator, published on 5 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
The Seraphinite Accelerator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'seraph_accel_prep' parameter in versions up to, and including, 2.29.15. This is due to the CacheExtractPreparePageParams() function using PHP's loose inequality operator (!=) to compare the expected HMAC string against the JSON-decoded 'nonce' value — supplying the JSON boolean true causes any non-empty HMAC string to compare as loosely equal, bypassing the signature check — combined with insufficient output escaping in the _CbContentFinishSkip() function, which concatenates the attacker-controlled 'selfTest' field directly into the HTML response body. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Weakness: CWE-79
Which versions are affected by CVE-2026-17532?
How do I fix CVE-2026-17532?
No fix has been published for CVE-2026-17532 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-17532 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-17532 exists.
Public exploit code: 1 Nuclei template and 2 proofs of concept on GitHub.
Sources
Also known as GHSA-ff83-hfr5-72ch.