Search
Find a vulnerability
Search criteria
10 vulnerabilities found for Autoptimize by optimizingmatters
CVE-2026-78471 (GCVE-0-2026-78471)
Vulnerability from nvd – Published: 2026-10-02 05:30 – Updated: 2026-10-02 05:30
VLAI
EPSS
VEX
Title
Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Summary
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled Autoptimize's 'Lazy-load images?' option, the w3-total-cache/w3-total-cache.php file to be present on disk with the plugin disabled, a class named Minify_HTML to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator before the payload renders.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| optimizingmatters | Autoptimize |
Affected:
0 , ≤ 3.1.15.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Autoptimize",
"vendor": "optimizingmatters",
"versions": [
{
"lessThanOrEqual": "3.1.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "theviper17y"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled Autoptimize\u0027s \u0027Lazy-load images?\u0027 option, the w3-total-cache/w3-total-cache.php file to be present on disk with the plugin disabled, a class named Minify_HTML to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator before the payload renders."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T05:30:18.257Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b14f574d-1490-423e-9ef3-ce8f844cb8f0?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeImages.php#L1232"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeImages.php#L960"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeImages.php#L908"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3713884%40autoptimize%2Ftags%2F3.1.16\u0026old=3657650%40autoptimize%2Ftags%2F3.1.15.1"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3713884/autoptimize/trunk/classes/autoptimizeImages.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-24T17:04:26.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-01T16:42:10.000Z",
"value": "Disclosed"
}
],
"title": "Autoptimize \u003c= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-78471",
"datePublished": "2026-10-02T05:30:18.257Z",
"dateReserved": "2026-08-24T16:49:16.127Z",
"dateUpdated": "2026-10-02T05:30:18.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14995 (GCVE-0-2026-14995)
Vulnerability from nvd – Published: 2026-10-01 08:28 – Updated: 2026-10-01 14:02
VLAI
EPSS
VEX
Title
Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
Summary
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured, as this is the precondition for unauthenticated frontend requests to trigger queue entries via ao_ccss_enqueue().
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 14:02 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| optimizingmatters | Autoptimize |
Affected:
0 , ≤ 3.1.15.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14995",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T14:02:35.543960Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T14:02:56.840Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Autoptimize",
"vendor": "optimizingmatters",
"versions": [
{
"lessThanOrEqual": "3.1.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lhking"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured, as this is the precondition for unauthenticated frontend requests to trigger queue entries via ao_ccss_enqueue()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T08:28:40.341Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1704cffa-75ed-415e-864f-de7ff8eea8dc?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/critcss-inc/admin_settings_queue.js.php#L125"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeCriticalCSSEnqueue.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeCriticalCSSEnqueue.php#L218"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/critcss-inc/admin_settings_queue.php#L82"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3713884%40autoptimize\u0026new=3713884%40autoptimize"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-07T19:13:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-30T20:10:48.000Z",
"value": "Disclosed"
}
],
"title": "Autoptimize \u003c= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-14995",
"datePublished": "2026-10-01T08:28:40.341Z",
"dateReserved": "2026-07-07T18:57:46.336Z",
"dateUpdated": "2026-10-01T14:02:56.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2430 (GCVE-0-2026-2430)
Vulnerability from nvd – Published: 2026-03-20 23:25 – Updated: 2026-04-08 17:28
VLAI
EPSS
VEX
Title
Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes
Summary
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the `add_lazyload` function that replaces all occurrences of `\ssrc=` in image tags without limiting to the actual attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by crafting an image tag where the `src` URL contains a space followed by `src=`, causing the regex to break the HTML structure and promote text inside attribute values into executable HTML attributes.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-23 18:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| optimizingmatters | Autoptimize |
Affected:
0 , ≤ 3.1.14
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2430",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-23T18:26:25.579305Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T18:27:21.821Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Autoptimize",
"vendor": "optimizingmatters",
"versions": [
{
"lessThanOrEqual": "3.1.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matthew Rollings"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the `add_lazyload` function that replaces all occurrences of `\\ssrc=` in image tags without limiting to the actual attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by crafting an image tag where the `src` URL contains a space followed by `src=`, causing the regex to break the HTML structure and promote text inside attribute values into executable HTML attributes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:28:09.590Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc5c4d7-09dc-45bf-a3c7-5a0757e3110a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeImages.php#L987"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L987"
},
{
"url": "https://github.com/futtta/autoptimize/commit/a0f87112fe80b5a97b036229c41cb18454392858"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3482530%40autoptimize\u0026new=3482530%40autoptimize\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-12T21:28:18.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-03-20T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Autoptimize \u003c= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-2430",
"datePublished": "2026-03-20T23:25:14.410Z",
"dateReserved": "2026-02-12T21:12:58.849Z",
"dateUpdated": "2026-04-08T17:28:09.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2352 (GCVE-0-2026-2352)
Vulnerability from nvd – Published: 2026-03-20 23:25 – Updated: 2026-04-08 16:56
VLAI
EPSS
VEX
Title
Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value
Summary
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the "Image optimization" or "Lazy-load images" setting is enabled in the plugin configuration.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-25 13:42 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| optimizingmatters | Autoptimize |
Affected:
0 , ≤ 3.1.14
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2352",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T13:42:22.789814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T13:42:29.084Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Autoptimize",
"vendor": "optimizingmatters",
"versions": [
{
"lessThanOrEqual": "3.1.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hung Nguyen"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027ao_post_preload\u0027 meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `\u003clink\u003e` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the \"Image optimization\" or \"Lazy-load images\" setting is enabled in the plugin configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:56:20.012Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3f9891-710e-49e4-b388-aa6d99c01840?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeMetabox.php#L276"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L804"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L938"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeMetabox.php#L276"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeImages.php#L804"
},
{
"url": "https://github.com/futtta/autoptimize/commit/60d1e487e536a97ae317784f8aeaf0d2e93cd717"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3482530%40autoptimize\u0026new=3482530%40autoptimize\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-11T16:53:35.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-03-20T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Autoptimize \u003c= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027ao_post_preload\u0027 Meta Value"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-2352",
"datePublished": "2026-03-20T23:25:12.386Z",
"dateReserved": "2026-02-11T16:37:03.973Z",
"dateUpdated": "2026-04-08T16:56:20.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-13401 (GCVE-0-2025-13401)
Vulnerability from nvd – Published: 2025-12-03 13:52 – Updated: 2026-04-08 16:59
VLAI
EPSS
VEX
Title
Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Summary
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the "create_img_preload_tag" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-03 14:47 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| optimizingmatters | Autoptimize |
Affected:
0 , ≤ 3.1.13
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-13401",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-03T14:47:52.328274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-03T14:47:57.880Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Autoptimize",
"vendor": "optimizingmatters",
"versions": [
{
"lessThanOrEqual": "3.1.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhammad Yudha - DJ"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the \"create_img_preload_tag\" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:59:48.496Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed5bdb3-c4cd-4982-bc47-feeff527e284?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3401333/autoptimize"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-10T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2025-11-19T18:29:52.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-12-03T00:32:37.000Z",
"value": "Disclosed"
}
],
"title": "Autoptimize \u003c= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-13401",
"datePublished": "2025-12-03T13:52:44.692Z",
"dateReserved": "2025-11-19T10:38:07.284Z",
"dateUpdated": "2026-04-08T16:59:48.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-78471 (GCVE-0-2026-78471)
Vulnerability from cvelistv5 – Published: 2026-10-02 05:30 – Updated: 2026-10-02 05:30
VLAI
EPSS
VEX
Title
Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Summary
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled Autoptimize's 'Lazy-load images?' option, the w3-total-cache/w3-total-cache.php file to be present on disk with the plugin disabled, a class named Minify_HTML to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator before the payload renders.
Severity
5.4 (Medium)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| optimizingmatters | Autoptimize |
Affected:
0 , ≤ 3.1.15.1
(semver)
|
{
"containers": {
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Autoptimize",
"vendor": "optimizingmatters",
"versions": [
{
"lessThanOrEqual": "3.1.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "theviper17y"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled Autoptimize\u0027s \u0027Lazy-load images?\u0027 option, the w3-total-cache/w3-total-cache.php file to be present on disk with the plugin disabled, a class named Minify_HTML to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator before the payload renders."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-02T05:30:18.257Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b14f574d-1490-423e-9ef3-ce8f844cb8f0?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeImages.php#L1232"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeImages.php#L960"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeImages.php#L908"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026new=3713884%40autoptimize%2Ftags%2F3.1.16\u0026old=3657650%40autoptimize%2Ftags%2F3.1.15.1"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3713884/autoptimize/trunk/classes/autoptimizeImages.php"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-24T17:04:26.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-10-01T16:42:10.000Z",
"value": "Disclosed"
}
],
"title": "Autoptimize \u003c= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-78471",
"datePublished": "2026-10-02T05:30:18.257Z",
"dateReserved": "2026-08-24T16:49:16.127Z",
"dateUpdated": "2026-10-02T05:30:18.257Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-14995 (GCVE-0-2026-14995)
Vulnerability from cvelistv5 – Published: 2026-10-01 08:28 – Updated: 2026-10-01 14:02
VLAI
EPSS
VEX
Title
Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
Summary
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured, as this is the precondition for unauthenticated frontend requests to trigger queue entries via ao_ccss_enqueue().
Severity
7.2 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-01 14:02 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
6 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| optimizingmatters | Autoptimize |
Affected:
0 , ≤ 3.1.15.1
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-14995",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-01T14:02:35.543960Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T14:02:56.840Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Autoptimize",
"vendor": "optimizingmatters",
"versions": [
{
"lessThanOrEqual": "3.1.15.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "lhking"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the Critical CSS feature to be active with a valid API key configured, as this is the precondition for unauthenticated frontend requests to trigger queue entries via ao_ccss_enqueue()."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-01T08:28:40.341Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/1704cffa-75ed-415e-864f-de7ff8eea8dc?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/critcss-inc/admin_settings_queue.js.php#L125"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeCriticalCSSEnqueue.php#L57"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeCriticalCSSEnqueue.php#L218"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/critcss-inc/admin_settings_queue.php#L82"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3713884%40autoptimize\u0026new=3713884%40autoptimize"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-07-07T19:13:00.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-30T20:10:48.000Z",
"value": "Disclosed"
}
],
"title": "Autoptimize \u003c= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-14995",
"datePublished": "2026-10-01T08:28:40.341Z",
"dateReserved": "2026-07-07T18:57:46.336Z",
"dateUpdated": "2026-10-01T14:02:56.840Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2430 (GCVE-0-2026-2430)
Vulnerability from cvelistv5 – Published: 2026-03-20 23:25 – Updated: 2026-04-08 17:28
VLAI
EPSS
VEX
Title
Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes
Summary
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the `add_lazyload` function that replaces all occurrences of `\ssrc=` in image tags without limiting to the actual attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by crafting an image tag where the `src` URL contains a space followed by `src=`, causing the regex to break the HTML structure and promote text inside attribute values into executable HTML attributes.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-23 18:26 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| optimizingmatters | Autoptimize |
Affected:
0 , ≤ 3.1.14
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2430",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-23T18:26:25.579305Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-23T18:27:21.821Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Autoptimize",
"vendor": "optimizingmatters",
"versions": [
{
"lessThanOrEqual": "3.1.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Matthew Rollings"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the `add_lazyload` function that replaces all occurrences of `\\ssrc=` in image tags without limiting to the actual attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by crafting an image tag where the `src` URL contains a space followed by `src=`, causing the regex to break the HTML structure and promote text inside attribute values into executable HTML attributes."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T17:28:09.590Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc5c4d7-09dc-45bf-a3c7-5a0757e3110a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeImages.php#L987"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L987"
},
{
"url": "https://github.com/futtta/autoptimize/commit/a0f87112fe80b5a97b036229c41cb18454392858"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3482530%40autoptimize\u0026new=3482530%40autoptimize\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-12T21:28:18.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-03-20T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Autoptimize \u003c= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-2430",
"datePublished": "2026-03-20T23:25:14.410Z",
"dateReserved": "2026-02-12T21:12:58.849Z",
"dateUpdated": "2026-04-08T17:28:09.590Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-2352 (GCVE-0-2026-2352)
Vulnerability from cvelistv5 – Published: 2026-03-20 23:25 – Updated: 2026-04-08 16:56
VLAI
EPSS
VEX
Title
Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value
Summary
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the "Image optimization" or "Lazy-load images" setting is enabled in the plugin configuration.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-03-25 13:42 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
8 references
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| optimizingmatters | Autoptimize |
Affected:
0 , ≤ 3.1.14
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-2352",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-03-25T13:42:22.789814Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-03-25T13:42:29.084Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Autoptimize",
"vendor": "optimizingmatters",
"versions": [
{
"lessThanOrEqual": "3.1.14",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Hung Nguyen"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027ao_post_preload\u0027 meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `\u003clink\u003e` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the \"Image optimization\" or \"Lazy-load images\" setting is enabled in the plugin configuration."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:56:20.012Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5f3f9891-710e-49e4-b388-aa6d99c01840?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeMetabox.php#L276"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L804"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L938"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeMetabox.php#L276"
},
{
"url": "https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeImages.php#L804"
},
{
"url": "https://github.com/futtta/autoptimize/commit/60d1e487e536a97ae317784f8aeaf0d2e93cd717"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3482530%40autoptimize\u0026new=3482530%40autoptimize\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2026-02-11T16:53:35.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-03-20T00:00:00.000Z",
"value": "Disclosed"
}
],
"title": "Autoptimize \u003c= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via \u0027ao_post_preload\u0027 Meta Value"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-2352",
"datePublished": "2026-03-20T23:25:12.386Z",
"dateReserved": "2026-02-11T16:37:03.973Z",
"dateUpdated": "2026-04-08T16:56:20.012Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2025-13401 (GCVE-0-2025-13401)
Vulnerability from cvelistv5 – Published: 2025-12-03 13:52 – Updated: 2026-04-08 16:59
VLAI
EPSS
VEX
Title
Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Summary
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the "create_img_preload_tag" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Severity
6.4 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-12-03 14:47 UTC
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| optimizingmatters | Autoptimize |
Affected:
0 , ≤ 3.1.13
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-13401",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-03T14:47:52.328274Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-12-03T14:47:57.880Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Autoptimize",
"vendor": "optimizingmatters",
"versions": [
{
"lessThanOrEqual": "3.1.13",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Muhammad Yudha - DJ"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the \"create_img_preload_tag\" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-04-08T16:59:48.496Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed5bdb3-c4cd-4982-bc47-feeff527e284?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/changeset/3401333/autoptimize"
}
],
"timeline": [
{
"lang": "en",
"time": "2025-11-10T00:00:00.000Z",
"value": "Discovered"
},
{
"lang": "en",
"time": "2025-11-19T18:29:52.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2025-12-03T00:32:37.000Z",
"value": "Disclosed"
}
],
"title": "Autoptimize \u003c= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2025-13401",
"datePublished": "2025-12-03T13:52:44.692Z",
"dateReserved": "2025-11-19T10:38:07.284Z",
"dateUpdated": "2026-04-08T16:59:48.496Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}