Vulnerabilities

TI-2026-65864 CVE-2026-78471 · GHSA-fcq7-9xcx-6xxw

Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

LOW 24

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 5.4 Network No auth No interaction EPSS 0.00221 Published 2026-10-02 No fix listed CWE-79

TI-2026-12621 CVE-2026-14995 · GHSA-v9f4-5xpx-364q

Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path

LOW 31

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Path in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00284 Published 2026-10-01 No fix listed CWE-79

TI-2026-02062 CVE-2026-2430 · GHSA-8wqg-98qw-6h95

Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes

LOW 28

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00211 Published 2026-03-20 No fix listed CWE-79

TI-2026-01989 CVE-2026-2352 · GHSA-jph4-mv6f-wg9x

Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value

LOW 28

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00266 Published 2026-03-20 No fix listed CWE-79

TI-2025-12251 CVE-2025-13401 · GHSA-w95g-m3rh-jhrr

Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

LOW 28

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escapi…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00315 Published 2025-12-03 No fix listed CWE-79

TI-2022-03722 CVE-2022-4057 · GHSA-3wg2-8vcr-5m74

Autoptimize < 3.1.0 - Sensitive Data Disclosure

MEDIUM 63

The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01533 Published 2023-01-02 Fixed in 3.1.0 CWE-425

Vulnerabilities

Filters

Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via REQUEST_URI Path

Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes

Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value

Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting

Autoptimize < 3.1.0 - Sensitive Data Disclosure