Autoptimize EUVD-2026-13842

While the CVSS 3.1 score of 6.4 indicates moderate severity with network-based attack vector (AV:N) and low attack complexity (AC:L), the real-world exploitability is constrained by several factors that lower practical risk below the numerical score suggests. The vulnerability requires PR:L (low privilege level), meaning only authenticated users with Contributor role or above can exploit it—a significant hurdle in most WordPress deployments where contributor access is relatively restricted. The UI:N (no user interaction required) for the attack itself is neutral, but the payload only executes when legitimate users visit the injected page, creating a delivery requirement. The scope change (S:C) indicates cross-context impact, raising the score appropriately. Critically, a patch is available (evidenced by the GitHub commit reference showing a fix has been implemented), and vendor Wordfence documentation confirms remediation pathways exist. No evidence from provided sources indicates active in-the-wild exploitation or CISA KEV inclusion, which would be stronger indicators of immediate threat. The automatable nature of the attack is moderate—while script injection is technically automatable, the requirement for authenticated access and the targeted nature of stored XSS limits mass-exploitation potential compared to unauthenticated RCE vulnerabilities. In SSVC framework terms, this presents exploitation credible (patch exists, attack complexity is low) but limited attack surface and requires compromised or malicious contributor accounts.

An attacker with a compromised or intentionally-created Contributor account logs into a WordPress site running Autoptimize 3.1.14 and creates a blog post containing a crafted image tag with a malicious src URL such as <img src='https://example.com/image.jpg src=onload=alert(document.cookie)'>. When the page is processed by Autoptimize's lazy-loading function, the regex matches the space-src pattern and breaks the HTML, transforming the tag structure in a way that injects the onload=alert(document.cookie) as an executable attribute. Subsequently, when legitimate website visitors view this post, the malicious JavaScript executes in their browsers within the website's security context, allowing the attacker to steal session cookies, perform actions on behalf of users, or inject further malicious content into the page DOM. No public proof-of-concept has been referenced in the provided intelligence, but the attack complexity is low given the straightforward nature of regex-based string manipulation and the predictable behavior of image tag parsing.