Optimizingmatters
Monthly
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) lets an unauthenticated attacker plant arbitrary JavaScript in the Critical CSS settings queue by supplying a malicious REQUEST_URI path that the plugin stores without sanitization and later renders without escaping. The injection path is only reachable when the non-default Critical CSS feature is active and a valid Critical CSS API key is configured, which is what allows unauthenticated frontend requests to create queue entries through ao_ccss_enqueue(); the payload then fires when a privileged user opens the affected admin queue view, giving a scope change and low-integrity/confidentiality impact rather than full site takeover. Assessment notes the effective CVSS vector as AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring victim interaction (a user viewing the injected page) despite the vendor's UI:N rating, and no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) allows unauthenticated attackers to inject arbitrary JavaScript through the blog comment Author Name field, which is stored and later rendered without adequate escaping, executing in the browser of anyone viewing the affected page. The attack is tightly gated, however: an administrator must have enabled Autoptimize's 'Lazy-load images?' option, a disabled W3 Total Cache installation must still have w3-total-cache/w3-total-cache.php present on disk, a class named Minify_HTML must be loaded into scope by some other plugin, and a comment moderator must approve the malicious comment before the payload renders. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a low-priority, high-friction issue affecting only sites that happen to match that exact plugin and file combination; default WordPress plus Autoptimize installations are not exploitable.
The Autoptimize WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the lazy-loading image processing function that allows authenticated attackers with Contributor-level access to inject arbitrary web scripts into pages. The flaw exists in all versions up to and including 3.1.14 and stems from an overly permissive regular expression that fails to properly validate image tag attributes, enabling attackers to craft malicious image tags that break HTML structure and promote attribute values into executable code. This vulnerability carries a moderate CVSS score of 6.4 and requires user interaction for stored XSS payloads to execute when pages are accessed.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Autoptimize WordPress plugin through version 3.1.14, caused by insufficient input sanitization in the ao_metabox_save() function and missing output escaping when rendering the 'ao_post_preload' meta value into HTML link tags. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes whenever users access pages with the Image optimization or Lazy-load images settings enabled, potentially affecting all users of compromised sites. The vulnerability has been patched and proof-of-concept code is available in the referenced GitHub commit.
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) lets an unauthenticated attacker plant arbitrary JavaScript in the Critical CSS settings queue by supplying a malicious REQUEST_URI path that the plugin stores without sanitization and later renders without escaping. The injection path is only reachable when the non-default Critical CSS feature is active and a valid Critical CSS API key is configured, which is what allows unauthenticated frontend requests to create queue entries through ao_ccss_enqueue(); the payload then fires when a privileged user opens the affected admin queue view, giving a scope change and low-integrity/confidentiality impact rather than full site takeover. Assessment notes the effective CVSS vector as AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, requiring victim interaction (a user viewing the injected page) despite the vendor's UI:N rating, and no public exploit code has been identified at time of analysis and the issue is not in CISA KEV.
Stored cross-site scripting in the Autoptimize WordPress plugin (all versions up to and including 3.1.15.1) allows unauthenticated attackers to inject arbitrary JavaScript through the blog comment Author Name field, which is stored and later rendered without adequate escaping, executing in the browser of anyone viewing the affected page. The attack is tightly gated, however: an administrator must have enabled Autoptimize's 'Lazy-load images?' option, a disabled W3 Total Cache installation must still have w3-total-cache/w3-total-cache.php present on disk, a class named Minify_HTML must be loaded into scope by some other plugin, and a comment moderator must approve the malicious comment before the payload renders. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so this is a low-priority, high-friction issue affecting only sites that happen to match that exact plugin and file combination; default WordPress plus Autoptimize installations are not exploitable.
The Autoptimize WordPress plugin contains a Stored Cross-Site Scripting (XSS) vulnerability in the lazy-loading image processing function that allows authenticated attackers with Contributor-level access to inject arbitrary web scripts into pages. The flaw exists in all versions up to and including 3.1.14 and stems from an overly permissive regular expression that fails to properly validate image tag attributes, enabling attackers to craft malicious image tags that break HTML structure and promote attribute values into executable code. This vulnerability carries a moderate CVSS score of 6.4 and requires user interaction for stored XSS payloads to execute when pages are accessed.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Autoptimize WordPress plugin through version 3.1.14, caused by insufficient input sanitization in the ao_metabox_save() function and missing output escaping when rendering the 'ao_post_preload' meta value into HTML link tags. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript that executes whenever users access pages with the Image optimization or Lazy-load images settings enabled, potentially affecting all users of compromised sites. The vulnerability has been patched and proof-of-concept code is available in the referenced GitHub commit.