CVE-2026-17532 Details.
Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting
Atlas does not check this one. Needs a scripted sequence.
This check is a series of requests where each step depends on the last, often after logging in. Atlas runs single, read-only probes, so it does not run this one.
About CVE-2026-17532. What It Means.
The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraph_accel_prep parameter. CacheExtractPreparePageParams() compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON boolean true satisfied the comparison and bypassed the signature check, and _CbContentFinishSkip() then concatenated the attacker-controlled selfTest field straight into the response…
Affected Product. What Is Hit.
- Vendor
- seraphinite
- Product
- Seraphinite Accelerator
References. Where To Read More.
FAQ
Common Questions.
Seraphinite Accelerator <= 2.29.18 - Cross-Site Scripting. The Seraphinite Accelerator plugin for WordPress up to and including 2.29.18 was vulnerable to reflected cross-site scripting through the seraph_accel_prep parameter. CacheExtractPreparePageParams() compared the expected HMAC against the JSON-decoded nonce with PHP's loose != operator, so a JSON boolean true satisfied the comparison and bypassed the signature check, and _CbContentFinishSkip() then concatenated the attacker-controlled selfTest field straight into the response…
No. This check is a series of requests where each step depends on the last, often after logging in. Atlas runs single, read-only probes, so it does not run this one. The facts about CVE-2026-17532 are on this page, and you can request a demo to see how Brandefense watches your whole external attack surface.
CVE-2026-17532 is not on the CISA Known Exploited Vulnerabilities list at the time of writing, but it is still worth fixing.
Update Seraphinite Accelerator to the latest version from the vendor, or follow the vendor's advice to switch off the affected feature. Vendor links are listed on this page when they are known.
This page lists the public facts about CVE-2026-17532. Atlas does not run a check for it, so nothing here says whether a particular site is affected.