EUVD-2026-54883
GHSA-x8x4-c789-5r5g
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network injection (AV:N, PR:N, AC:L); admin must view dashboard to trigger (UI:R); script executes cross-context in admin browser (S:C); limited session/DOM impact only (C:L, I:L, A:N).
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
AnalysisAI
Stored cross-site scripting in the LWS Optimize WordPress plugin (all versions before 4.1.2) enables unauthenticated remote attackers to inject persistent JavaScript via the plugin's analytics endpoint, which then executes in the browser of any administrator who views the affected dashboard page. The vulnerability requires no authentication to exploit the injection phase, making mass poisoning of sites feasible before any admin interaction occurs. No public exploit is identified at time of analysis; a vendor-released patch is available in version 4.1.2.
Technical ContextAI
LWS Optimize is a WordPress performance optimization plugin that exposes an analytics collection endpoint accepting unauthenticated HTTP submissions. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the stored XSS subvariant: submitted analytics values are persisted to the database without adequate sanitization or output escaping, then reflected back into the administrative dashboard interface without encoding. Unlike reflected XSS, stored XSS payloads persist until explicitly removed, meaning a single attacker request can affect every subsequent administrator session that visits the dashboard. The affected version range is LWS Optimize 0 through less than 4.1.2, as confirmed by EUVD-2026-54883.
RemediationAI
Update the LWS Optimize WordPress plugin to version 4.1.2 or later, which contains the vendor-released patch confirmed via the WPScan advisory at https://wpscan.com/vulnerability/f8520320-527b-4b30-9bac-f6e538154a40/. If immediate upgrade is not possible, restrict administrative dashboard access by IP allowlist or HTTP basic authentication at the web server or reverse proxy layer - this does not prevent payload injection but eliminates the execution trigger while the restriction is in place. Alternatively, blocking unauthenticated POST requests to the analytics endpoint at a WAF or application firewall layer would prevent payload storage, though this may degrade analytics functionality. Any stored payloads injected prior to patching should be manually reviewed and purged from the database, as patching alone does not remove previously stored malicious content.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today