{"error":0,"message":null,"data":{"name":"Autoptimize","plugin":"autoptimize","link":"https:\/\/wordpress.org\/plugins\/autoptimize\/","latest":"1775288640","closed":0,"closed_reason":null,"closed_date":null,"vulnerability":[{"uuid":"766e244ac80d981df16e363225d56c10db1cfba63c9f5b8f1f5f751d4d2948f9","name":"Autoptimize [autoptimize] < 2.7.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.7.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-24378","name":"CVE-2021-24378","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-24378","description":"[en] The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.","date":"2021-06-21"},{"id":"df870e37a4a506c5c8b22b0581a9b15e8a20c360","name":"WordPress Autoptimize plugin <= 2.7.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/autoptimize\/vulnerability\/wordpress-autoptimize-plugin-2-7-7-authenticated-stored-cross-site-scripting-xss-vulnerability","description":"Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Marcin W\u0119g\u0142owski in WordPress Autoptimize plugin (versions <= 2.7.7).","date":"2020-10-09"},{"id":"375bd694-1a30-41af-bbd4-8a8ee54f0dbf","name":"Autoptimize &lt; 2.7.8 - Authenticated Stored XSS via File Upload","link":"https:\/\/wpscan.com\/vulnerability\/375bd694-1a30-41af-bbd4-8a8ee54f0dbf","description":"The plugin does not check for malicious files such as .html in the archive uploaded via the &#039;Import Settings&#039; feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.","date":null},{"id":"b58746513aa55ab4d4a1180488b5e83ad09016aa","name":"Autoptimize <= 2.7.7 - Unsafe File Upload to Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/autoptimize\/autoptimize-277-unsafe-file-upload-to-cross-site-scripting","description":"The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.","date":"2020-10-09"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"4.8","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"4.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"49b1925eca12ae7992e3976f63794f20784b2f373ba2df3c8a6019008523f22e","name":"Autoptimize [autoptimize] < 2.7.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.7.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-24376","name":"CVE-2021-24376","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-24376","description":"[en] The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the \"Import Settings\" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the \"Import Settings\" functionality to achieve Remote Code Execution.","date":"2021-06-21"},{"id":"aa68dfd8c7f7454f7098a259d2d8ada3aab2e63f","name":"WordPress Autoptimize plugin <= 2.7.7 - Arbitrary File Upload via \"Import Settings\" vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/autoptimize\/vulnerability\/wordpress-autoptimize-plugin-2-7-7-arbitrary-file-upload-via-import-settings-vulnerability","description":"Arbitrary File Upload via \"Import Settings\" vulnerability discovered by Marcin W\u0119g\u0142owski in WordPress Autoptimize plugin (versions <= 2.7.7).","date":"2020-10-09"},{"id":"93edcc23-894a-46c2-84d2-407dcb64ba1e","name":"Autoptimize &lt; 2.7.8 - Arbitrary File Upload via &quot;Import Settings&quot;","link":"https:\/\/wpscan.com\/vulnerability\/93edcc23-894a-46c2-84d2-407dcb64ba1e","description":"The plugin attempts to delete malicious files (such as .php) form the uploaded archive via the &quot;Import Settings&quot; feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the &quot;Import Settings&quot; functionality to achieve Remote Code Execution.","date":null},{"id":"ef161a7b2edd728d02e44398288eb48bbb765e25","name":"Autoptimize <= 2.7.7 - Arbitrary File Upload (and Remote Code Execution) via Import Settings","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/autoptimize\/autoptimize-277-arbitrary-file-upload-and-remote-code-execution-via-import-settings","description":"The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the \"Import Settings\" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the \"Import Settings\" functionality to achieve Remote Code Execution.","date":"2020-10-09"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"9.8","severity":"c","exploitable":"3.9","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"9.8","severity":"critical","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"3.9","impact":"5.9"},"cwe":[{"cwe":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type","description":"The product allows the upload or transfer of dangerous file types that are automatically processed within its environment."}]}},{"uuid":"76668cf68a07603bdde164dc64a8a266fbf47a01e06d4d076bbb31d8df0429bc","name":"Autoptimize [autoptimize] < 2.7.8","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.7.8","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-24377","name":"CVE-2021-24377","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-24377","description":"[en] The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.","date":"2021-06-21"},{"id":"e29444c8409c651d0cdbadae079d61852676147f","name":"WordPress Autoptimize plugin <= 2.7.7 - Race Condition leading to Remote Code Execution (RCE) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/autoptimize\/vulnerability\/wordpress-autoptimize-plugin-2-7-7-race-condition-leading-to-remote-code-execution-rce-vulnerability","description":"Race Condition leading to Remote Code Execution (RCE) vulnerability discovered by Marcin W\u0119g\u0142owski in WordPress Autoptimize plugin (versions <= 2.7.7).","date":"2020-10-09"},{"id":"85c0a564-2e56-413d-bc3a-1039343207e4","name":"Autoptimize &lt; 2.7.8 - Race Condition leading to RCE","link":"https:\/\/wpscan.com\/vulnerability\/85c0a564-2e56-413d-bc3a-1039343207e4","description":"The plugin attempts to remove potential malicious files from the extracted archive uploaded via the &#039;Import Settings&#039; feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.","date":null},{"id":"0a51382275fd48bf3fb34e56b9a7dcdb25863874","name":"Autoptimize <= 2.7.7 - Race Condition leading to Remote Code Execution","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/autoptimize\/autoptimize-277-race-condition-leading-to-remote-code-execution","description":"The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.","date":"2020-10-09"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"h","pr":"n","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"8.1","severity":"h","exploitable":"2.2","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:H\/PR:N\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"8.1","severity":"high","av":"network","ac":"high","pr":"none","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"2.2","impact":"5.9"},"cwe":[{"cwe":"CWE-362","name":"Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')","description":"The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently."}]}},{"uuid":"24a0611abb3753a71fdbe62dcd2e2b3e2b7ad9087aa89833d3a3c251aec0efe6","name":"Autoptimize [autoptimize] < 2.8.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.8.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2021-24332","name":"CVE-2021-24332","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2021-24332","description":"[en] The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues","date":"2021-05-24"},{"id":"6678e064-ce21-4bb2-8c50-061073fb22fb","name":"Autoptimize &lt; 2.8.4 - Authenticated Stored Cross-Site Scripting (XSS)","link":"https:\/\/wpscan.com\/vulnerability\/6678e064-ce21-4bb2-8c50-061073fb22fb","description":"The plugin was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues","date":null},{"id":"1901581869f10fd8d0bc3dbad81ee7af430cc179","name":"Autoptimize <= 2.8.3 - Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/autoptimize\/autoptimize-283-stored-cross-site-scripting","description":"The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues.","date":"2021-05-07"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"4.8","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"4.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"a6a1af19b38965161cc7c415fb4358915111bca0a4889993633cfd2caa2c39e7","name":"Autoptimize [autoptimize] < 2.7.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.7.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2020-24948","name":"CVE-2020-24948","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2020-24948","description":"[en] The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.","date":"2020-09-03"},{"id":"74203a56c173d29d9fdd9500873316b81cdadb83","name":"WordPress Autoptimize plugin <= 2.7.6 - Authenticated Arbitrary File Upload vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/autoptimize\/vulnerability\/wordpress-autoptimize-plugin-2-7-6-authenticated-arbitrary-file-upload-vulnerability","description":"Authenticated Arbitrary File Upload vulnerability found by Nguyen Van Khanh (SunCSR) in WordPress Autoptimize plugin (versions <= 2.7.6).","date":"2020-08-24"},{"id":"56dc9a8c-05ae-4881-a92e-e213eab866a0","name":"Autoptimize &lt; 2.7.7 - Authenticated Arbitrary File Upload","link":"https:\/\/wpscan.com\/vulnerability\/56dc9a8c-05ae-4881-a92e-e213eab866a0","description":"The ao_ccss_import AJAX call does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE.","date":null},{"id":"c846c6291a23af6d524d749cc93f1886d5cad57f","name":"Autoptimize <= 2.7.6 - Authenticated Arbitrary File Upload","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/autoptimize\/autoptimize-276-authenticated-arbitrary-file-upload","description":"The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.","date":"2020-08-24"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"h","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"7.2","severity":"h","exploitable":"1.2","impact":"5.9"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:N\/S:U\/C:H\/I:H\/A:H","score":"7.2","severity":"high","av":"network","ac":"low","pr":"high","ui":"none","s":"unchanged","c":"high","i":"high","a":"high","exploitable":"1.2","impact":"5.9"},"cwe":[{"cwe":"CWE-434","name":"Unrestricted Upload of File with Dangerous Type","description":"The product allows the upload or transfer of dangerous file types that are automatically processed within its environment."}]}},{"uuid":"75dc0c47e30264ff0067c506a28b4df98527fed2ea008cc98c235341e95c02e8","name":"Autoptimize [autoptimize] < 2.8.4","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.8.4","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"40af50fc504c00e8121d51aba499eaee861e5f0e","name":"WordPress Autoptimize plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/autoptimize\/vulnerability\/wordpress-autoptimize-plugin-2-8-3-authenticated-stored-cross-site-scripting-xss-vulnerability","description":"Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by m0ze in WordPress Autoptimize plugin (versions <= 2.8.3).","date":"2021-05-04"}],"impact":[]},{"uuid":"959a951d851ae3bfd39f0170e0d00ce04f20a4cbb994a6857cdd73239a166434","name":"Autoptimize [autoptimize] < 3.1.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.1.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2022-2635","name":"CVE-2022-2635","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-2635","description":"[en] The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)","date":"2022-09-16"},{"id":"8aaafacb06d9f237f96d3fbeb2bdab282a53bc33","name":"WordPress Autoptimize Plugin <= 3.1.0 - Authenticated Stored Cross-Site Scripting vulnerability","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/autoptimize\/vulnerability\/wordpress-autoptimize-3-1-0-authenticated-stored-cross-site-scripting-vulnerability","description":"Authenticated Stored Cross-Site Scripting vulnerability discovered by Raad Haddad in Autoptimize (versions <= 3.1.0)\nUpdate the WordPress Autoptimize plugin to the latest available version (at least 3.1.1).","date":"2022-08-17"},{"id":"a6a9c7f972d081b97325c592edf0f5325474c3d4","name":"Autoptimize <= 3.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Critical CSS Settings","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/autoptimize\/autoptimize-310-authenticated-admin-stored-cross-site-scripting-via-critical-css-settings","description":"The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the critical css settings rules in versions up to, and including, 3.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled. The issue was partially fixed in version 3.1.0 but a full fix was not made available until version 3.1.1.","date":"2022-07-19"},{"id":"219767a8-2427-42d5-8734-bd197d9ab46b","name":"Autoptimize &lt; 3.1.1 - Admin+ Stored Cross Site Scripting","link":"https:\/\/wpscan.com\/vulnerability\/219767a8-2427-42d5-8734-bd197d9ab46b","description":"The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"4.8","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"4.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}]}},{"uuid":"dc1ebacffc0f4f3fe3a069a9a8ac49443b62b0e816b10ca896488eeaa8b054de","name":"Autoptimize [autoptimize] < 3.1.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.1.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"e9d5f4af6b383424239e7d4a7d2561b798d4c6a3","name":"WordPress Autoptimize Plugin <= 3.0.4 is vulnerable to Sensitive Data Exposure","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/autoptimize\/vulnerability\/wordpress-autoptimize-plugin-3-0-4-sensitive-data-disclosure-vulnerability","description":"Update the WordPress Autoptimize plugin to the latest available version (at least 3.1.0).\nRaad Haddad (Cloudyrion GmbH) discovered and reported this Sensitive Data Exposure vulnerability in WordPress Autoptimize Plugin.  This vulnerability has been fixed in version 3.1.0.","date":null}],"impact":[]},{"uuid":"525d954896451cdb3e524bb90e7cdb2435cfbb94f10f748757df1f3b3d8df379","name":"Autoptimize [autoptimize] < 3.1.0","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.1.0","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2022-4057","name":"CVE-2022-4057","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-4057","description":"[en] The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.","date":"2023-01-02"},{"id":"ac1c9254673b97fe435eb9d2010a312a17f2632f","name":"Autoptimize <= 3.0.4 - Sensitive Information Disclosure","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/autoptimize\/autoptimize-304-sensitive-information-disclosure","description":"The Autoptimize plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 3.0.4 via the 'ao_ccss_export_callback' and 'ao_ccss_import_callback' functions. The settings.json file is not deleted in the import\/export callbacks, which could lead to the settings options being leaked.  This can allow unauthenticated attackers to extract sensitive data about the plugin's settings.","date":"2022-12-05"},{"id":"95ee1b9c-1971-4c35-8527-5764e9ed64af","name":"Autoptimize &lt; 3.1.0 - Sensitive Data Disclosure","link":"https:\/\/wpscan.com\/vulnerability\/95ee1b9c-1971-4c35-8527-5764e9ed64af","description":"The plugin uses an easily guessable path to store plugin&#039;s exported settings and logs.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","av":"n","ac":"l","pr":"n","ui":"n","s":"u","c":"l","i":"n","a":"n","score":"5.3","severity":"m","exploitable":"3.9","impact":"1.4"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:N\/UI:N\/S:U\/C:L\/I:N\/A:N","score":"5.3","severity":"medium","av":"network","ac":"low","pr":"none","ui":"none","s":"unchanged","c":"low","i":"none","a":"none","exploitable":"3.9","impact":"1.4"},"cwe":[{"cwe":"CWE-425","name":"Direct Request ('Forced Browsing')","description":"The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files."}],"ssvc":{"exploitation":"poc","automatable":"yes","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"6015bef414fc8f437e08d5539e62eef69bb040587448d085a332ce79587c686c","name":"Autoptimize [autoptimize] < 2.1.1","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"2.1.1","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"4c9457a43e483bbaa2b79f105f07221d22529f4d","name":"Autoptimize <= 2.1.0 - Unauthenticated Local File Inclusion","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/autoptimize\/autoptimize-210-unauthenticated-local-file-inclusion","description":"The Autoptimize plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.0. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included. This requires both JS and CSS aggregation, and the 'Also aggregate inline CSS' option to be set.","date":"2017-06-19"}],"impact":[]},{"uuid":"4327833d380fd52287dd635b10ca8b62b680b09a25bf3eff0242cfc0704bf167","name":"Autoptimize [autoptimize] < 3.1.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.1.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"959292096b267d9ffa55ee513be2fcd1d57400dc","name":"WordPress  Autoptimize Plugin  <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/autoptimize\/vulnerability\/wordpress-autoptimize-plugin-3-1-6-admin-stored-cross-site-scripting-xss-vulnerability","description":"Update the WordPress Autoptimize plugin to the latest available version (at least 3.1.7).\nAn unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Autoptimize Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 3.1.7.","date":"2023-04-23"}],"impact":[]},{"uuid":"f7ced184d064c31a8cc607081d57a175faa392af35ef853b317137831769b21a","name":"Autoptimize [autoptimize] < 3.1.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.1.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"5702d8bb28f9b76b26ac5e940389264b6751a3e6","name":"WordPress  Autoptimize Plugin  <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/autoptimize\/vulnerability\/wordpress-autoptimize-plugin-3-1-6-auth-stored-cross-site-scripting-xss-vulnerability","description":"Update the WordPress Autoptimize plugin to the latest available version (at least 3.1.7).\nAn unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Autoptimize Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site.  This vulnerability has been fixed in version 3.1.7.","date":"2023-04-25"}],"impact":[]},{"uuid":"ddb35fe6d49d6993ef1330758a25a55098196a328641307a672285c14862868c","name":"Autoptimize [autoptimize] < 3.1.7","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.1.7","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2023-2113","name":"CVE-2023-2113","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2023-2113","description":"[en] The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.","date":"2023-05-30"},{"id":"4d9d649e0d5fd846e86a12d77e35583e0192b354","name":"Autoptimize <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting via Critical CSS Rules","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/autoptimize\/autoptimize-316-authenticated-admin-stored-cross-site-scripting-via-critical-css-rules","description":"The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the critical css rules in versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.","date":"2023-04-25"},{"id":"ddb4c95d-bbee-4095-aed6-25f6b8e63011","name":"Autoptimize &lt; 3.1.7 - Admin+ Stored Cross-Site Scripting via Settings Import","link":"https:\/\/wpscan.com\/vulnerability\/ddb4c95d-bbee-4095-aed6-25f6b8e63011","description":"The plugin does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.","date":null}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"h","ui":"r","s":"c","c":"l","i":"l","a":"n","score":"4.8","severity":"m","exploitable":"1.7","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:H\/UI:R\/S:C\/C:L\/I:L\/A:N","score":"4.8","severity":"medium","av":"network","ac":"low","pr":"high","ui":"required","s":"changed","c":"low","i":"low","a":"none","exploitable":"1.7","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"860892cf48f88469e2c756284c3c36db1e2d2cad22a4827763920ed50f3979a3","name":"Autoptimize [autoptimize] < 3.1.14","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.1.14","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2025-13401","name":"CVE-2025-13401","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2025-13401","description":"[en] The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the \"create_img_preload_tag\" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-12-03"},{"id":"f33a9a0eac6e1a2543c35cb6f2aac06fc7f469af","name":"Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/autoptimize\/autoptimize-3113-authenticated-contributor-stored-cross-site-scripting","description":"The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the \"create_img_preload_tag\" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2025-12-03"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"c","c":"l","i":"l","a":"n","score":"6.4","severity":"m","exploitable":"3.1","impact":"2.7"},"cvss3":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N","score":"6.4","severity":"medium","av":"network","ac":"low","pr":"low","ui":"none","s":"changed","c":"low","i":"low","a":"none","exploitable":"3.1","impact":"2.7"},"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"c8d38377fdd0cf44b9596ba5ec7380e51f59752734a3361975eda10cd26376b8","name":"Autoptimize [autoptimize] < 3.1.15","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.1.15","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-2352","name":"Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-2352","description":"The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the \"Image optimization\" or \"Lazy-load images\" setting is enabled in the plugin configuration.","date":"0000-00-00"},{"id":"a3d2867ce0137558c2df7aa6a480ac1dd05c5fbc","name":"Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/autoptimize\/autoptimize-3114-authenticated-contributor-stored-cross-site-scripting-via-ao-post-preload-meta-value","description":"The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the \"Image optimization\" or \"Lazy-load images\" setting is enabled in the plugin configuration.","date":"2026-03-20"}],"impact":{"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"b332db01348b4a5cfb51f8afc36bcf190f5f89ce74eac5133e05b09515dadd6a","name":"Autoptimize [autoptimize] < 3.1.15","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.1.15","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-2430","name":"Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-2430","description":"The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the `add_lazyload` function that replaces all occurrences of `\\ssrc=` in image tags without limiting to the actual attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by crafting an image tag where the `src` URL contains a space followed by `src=`, causing the regex to break the HTML structure and promote text inside attribute values into executable HTML attributes.","date":"0000-00-00"},{"id":"bc7b14cf034afe4edea1beec19bd702f26c2b62a","name":"Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/autoptimize\/autoptimize-3114-authenticated-contributor-stored-cross-site-scripting-via-lazy-loaded-image-attributes","description":"The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the `add_lazyload` function that replaces all occurrences of `\\ssrc=` in image tags without limiting to the actual attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by crafting an image tag where the `src` URL contains a space followed by `src=`, causing the regex to break the HTML structure and promote text inside attribute values into executable HTML attributes.","date":"2026-03-20"}],"impact":{"ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","kev":false,"kev_date":null}}},{"uuid":"e0f8538f7c264e9e6d975be769ef4a4109d2c80a2d9b36ddf4a396528986a774","name":"Autoptimize [autoptimize] < 3.1.15","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"3.1.15","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2026-3220","name":"CVE-2026-3220","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2026-3220","description":"[en] The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache  WordPress plugin before 2.4.2, Speed Optimizer  WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.","date":"2026-05-18"},{"id":"bb4b688c8920d9e885df46041576158cd7662a39","name":"WordPress Autoptimize Plugin < 3.1.15 is vulnerable to Cross Site Scripting (XSS)","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/autoptimize\/vulnerability\/wordpress-autoptimize-plugin-3-1-15-unauthenticated-stored-xss-via-minify-library-vulnerability","description":"<p>WordPress Autoptimize Plugin < 3.1.15 is vulnerable to Cross Site Scripting (XSS)<\/p><p>Software: Autoptimize<\/p><p>Fixed in version 3.1.15 <\/p><p>Affected Version < 3.1.15<\/p><p>CVE: CVE-2026-3220<\/p>","date":"2026-06-11"},{"id":"b521a94f282c1a059e4a72181e243e4ad5b20cef","name":"Multiple Plugins <= Multiple Versions - Unauthenticated Stored Cross-Site Scripting","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/detail\/multiple-plugins-multiple-versions-unauthenticated-stored-cross-site-scripting","description":"Multiple plugins for WordPress are vulnerable to Stored Cross-Site Scripting in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","date":"2026-04-27"}],"impact":{"cwe":[{"cwe":"CWE-79","name":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","description":"The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users."}],"ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","kev":false,"kev_date":null}}}]},"updated":"1779167366"}