Removed polyfill filter

readme.txt

@@ -4,7 +4,7 @@ Tags: lazyload, lazy load, images, iframes, thumbnail, thumbnails, smiley, smili
 Requires at least: 4.7
 Tested up to: 6.3
 Requires PHP: 5.6
-Stable tag: 2.3.6
+Stable tag: 2.3.7
 Tags: lazy load, lazy loading, defer offscreen images, lazy load plugin, lazy load images, image lazy loading, iframe lazy load, video lazy load
 
 The best free lazy load plugin for WordPress. Lazy load images, videos, and iframes to improve performance and Core Web Vitals scores.
@@ -113,6 +113,9 @@ You can report any security bugs found in the source code of the site-reviews pl
 * [Increase Max upload file size](https://wordpress.org/plugins/upload-max-file-size/) is the best plugin to increase the upload file size limit to any value with one click.
 
 == Changelog ==
+= 2.3.7 =
+Bugfix: Removed `rocket_lazyload_polyfill` filter due to a vulnerability on polyfill
+
 = 2.3.5 =
 Enhancement: Test the plugin with latest version of WordPress v5.9.3
 Enhancement: Change WP readme content.

rocket-lazy-load.php

@@ -3,7 +3,7 @@
  * Plugin Name: Lazy Load - Optimize Images
  * Plugin URI: http://wordpress.org/plugins/rocket-lazy-load/
  * Description: The tiny Lazy Load script for WordPress without jQuery or others libraries.
- * Version: 2.3.6
+ * Version: 2.3.7
  * Requires PHP: 5.6
  * Author: WP Rocket
  * Author URI: https://wp-rocket.me
@@ -30,7 +30,7 @@
 
 defined( 'ABSPATH' ) || die( 'Cheatin\' uh?' );
 
-define( 'ROCKET_LL_VERSION', '2.3.6' );
+define( 'ROCKET_LL_VERSION', '2.3.7' );
 define( 'ROCKET_LL_WP_VERSION', '4.9' );
 define( 'ROCKET_LL_PHP_VERSION', '5.6' );
 define( 'ROCKET_LL_BASENAME', plugin_basename( __FILE__ ) );

src/Subscriber/LazyloadSubscriber.php

@@ -120,20 +120,10 @@ public function insertLazyloadScript() {
 		 */
 		$threshold = apply_filters( 'rocket_lazyload_threshold', 300 );
 
-		/**
-		 * Filters the use of the polyfill for intersectionObserver
-		 *
-		 * @since 3.3
-		 * @author Remy Perona
-		 *
-		 * @param bool $polyfill True to use the polyfill, false otherwise.
-		 */
-		$polyfill = apply_filters( 'rocket_lazyload_polyfill', false );
-
 		$script_args = [
 			'base_url' => ROCKET_LL_FRONT_JS_URL,
 			'version'  => '16.1',
-			'polyfill' => $polyfill,
+			'polyfill' => false,
 		];
 
 		$inline_args = [