Autoptimize
Monthly
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) lets an unauthenticated attacker plant arbitrary JavaScript in the Critical CSS settings queue by supplying a malicious REQUEST_URI path that the plugin stores without sanitization and later renders without escaping. The injection path is only reachable when the non-default Critical CSS feature is active and a valid Critical CSS API key is configured, which is what allows unauthenticated frontend requests to create queue entries through ao_ccss_enqueue(); the payload then fires when a privileged user opens the affected admin queue view, giving a scope change and low-integrity/confidentiality impact rather than full site takeover. Assessment notes the effective CVSS vector as AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring victim interaction (a user viewing the injected page) despite the vendor's UI:N rating, and no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated stored cross-site scripting affects the Autoptimize (before 3.1.15), Clearfy Cache (before 2.4.2), and Speed Optimizer (before 7.7.9) WordPress plugins, which share a common HTML-minification routine. Because the placeholder hash used to protect content during minification is predictable, an unauthenticated attacker who can get their input processed by the minifier can anticipate the placeholder format and inject arbitrary HTML attributes into the final rendered output. Publicly available exploit code exists (WPScan), a vendor patch is available, and EPSS is low (0.03%), but the impact is total per CISA SSVC; there is no public exploit identified as being used in active attacks.
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) allows unauthenticated attackers to inject arbitrary JavaScript through the blog comment Author Name field, which is stored and later rendered without adequate escaping, executing in the browser of anyone viewing the affected page. The attack is tightly gated, however: an administrator must have enabled Autoptimize's 'Lazy-load images?' option, a disabled W3 Total Cache installation must still have w3-total-cache/w3-total-cache.php present on disk, a class named Minify_HTML must be loaded into scope by some other plugin, and a comment moderator must approve the malicious comment before the payload renders. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a low-priority, high-friction issue affecting only sites that happen to match that exact plugin and file combination; default WordPress plus Autoptimize installations are not exploitable.
The Autoptimize WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the lazy-loading image processing function that allows authenticated attackers with Contributor-level access to inject arbitrary web scripts into pages. The flaw exists in all versions up to and including 3.1.14 and stems from an overly permissive regular expression that fails to properly validate image tag attributes, enabling attackers to craft malicious image tags that break HTML structure and promote attribute values into executable code. This vulnerability carries a moderate CVSS score of 6.4 and requires user interaction for stored XSS payloads to execute when pages are accessed.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Autoptimize WordPress plugin through version 3.1.14, caused by insufficient input sanitization in the ao_metabox_save() function and missing output escaping when rendering the 'ao_post_preload' meta value into HTML link tags. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes whenever users access pages with the Image optimization or Lazy-load images settings enabled, potentially affecting all users of compromised sites. The vulnerability has been patched and proof-of-concept code is available in the referenced GitHub commit.
The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) lets an unauthenticated attacker plant arbitrary JavaScript in the Critical CSS settings queue by supplying a malicious REQUEST_URI path that the plugin stores without sanitization and later renders without escaping. The injection path is only reachable when the non-default Critical CSS feature is active and a valid Critical CSS API key is configured, which is what allows unauthenticated frontend requests to create queue entries through ao_ccss_enqueue(); the payload then fires when a privileged user opens the affected admin queue view, giving a scope change and low-integrity/confidentiality impact rather than full site takeover. Assessment notes the effective CVSS vector as AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring victim interaction (a user viewing the injected page) despite the vendor's UI:N rating, and no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Unauthenticated stored cross-site scripting affects the Autoptimize (before 3.1.15), Clearfy Cache (before 2.4.2), and Speed Optimizer (before 7.7.9) WordPress plugins, which share a common HTML-minification routine. Because the placeholder hash used to protect content during minification is predictable, an unauthenticated attacker who can get their input processed by the minifier can anticipate the placeholder format and inject arbitrary HTML attributes into the final rendered output. Publicly available exploit code exists (WPScan), a vendor patch is available, and EPSS is low (0.03%), but the impact is total per CISA SSVC; there is no public exploit identified as being used in active attacks.
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) allows unauthenticated attackers to inject arbitrary JavaScript through the blog comment Author Name field, which is stored and later rendered without adequate escaping, executing in the browser of anyone viewing the affected page. The attack is tightly gated, however: an administrator must have enabled Autoptimize's 'Lazy-load images?' option, a disabled W3 Total Cache installation must still have w3-total-cache/w3-total-cache.php present on disk, a class named Minify_HTML must be loaded into scope by some other plugin, and a comment moderator must approve the malicious comment before the payload renders. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a low-priority, high-friction issue affecting only sites that happen to match that exact plugin and file combination; default WordPress plus Autoptimize installations are not exploitable.
The Autoptimize WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the lazy-loading image processing function that allows authenticated attackers with Contributor-level access to inject arbitrary web scripts into pages. The flaw exists in all versions up to and including 3.1.14 and stems from an overly permissive regular expression that fails to properly validate image tag attributes, enabling attackers to craft malicious image tags that break HTML structure and promote attribute values into executable code. This vulnerability carries a moderate CVSS score of 6.4 and requires user interaction for stored XSS payloads to execute when pages are accessed.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Autoptimize WordPress plugin through version 3.1.14, caused by insufficient input sanitization in the ao_metabox_save() function and missing output escaping when rendering the 'ao_post_preload' meta value into HTML link tags. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes whenever users access pages with the Image optimization or Lazy-load images settings enabled, potentially affecting all users of compromised sites. The vulnerability has been patched and proof-of-concept code is available in the referenced GitHub commit.
The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available and no vendor patch available.
The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.