TI-2022-03722 CVE-2022-4057 · GHSA-3wg2-8vcr-5m74
Autoptimize < 3.1.0 - Sensitive Data Disclosure
Priority MEDIUM 63
The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.
optimizingmatters
Records6All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
optimizingmatters records in CISA KEVNo optimizingmatters vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
6 records
TI-2026-12621 CVE-2026-14995 · GHSA-v9f4-5xpx-364q
Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path
Priority LOW 31
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping.
TI-2026-02062 CVE-2026-2430 · GHSA-8wqg-98qw-6h95
Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes
Priority LOW 28
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14.
TI-2026-01989 CVE-2026-2352 · GHSA-jph4-mv6f-wg9x
Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value
Priority LOW 28
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14.
TI-2025-12251 CVE-2025-13401 · GHSA-w95g-m3rh-jhrr
Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Priority LOW 28
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escapi…
TI-2026-65864 CVE-2026-78471 · GHSA-fcq7-9xcx-6xxw
Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
Priority LOW 24
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping.