https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 12:46:11 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-284578 EUVD-2026-284578 https://cve.radiocsirt.org/vuln/euvd-2026-284578 https://cve.radiocsirt.org/vuln/fkie_cve-2026-2352 <p>The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;ao_post_preload&#39; meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `&lt;link&gt;` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the &#34;Image optimization&#34; or &#34;Lazy-load images&#34; setting is enabled in the plugin configuration.</p> <p>The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;ao_post_preload&#39; meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `&lt;link&gt;` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the &#34;Image optimization&#34; or &#34;Lazy-load images&#34; setting is enabled in the plugin configuration.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-2352 https://cve.radiocsirt.org/vuln/ghsa-jph4-mv6f-wg9x <p>The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;ao_post_preload&#39; meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `&lt;link&gt;` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the &#34;Image optimization&#34; or &#34;Lazy-load images&#34; setting is enabled in the plugin configuration.</p> <p>The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the &#39;ao_post_preload&#39; meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `&lt;link&gt;` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the &#34;Image optimization&#34; or &#34;Lazy-load images&#34; setting is enabled in the plugin configuration.</p> https://cve.radiocsirt.org/vuln/ghsa-jph4-mv6f-wg9x