Stored Cross-Site Scripting in Autoptimize Plugin for WordPress

CVE-2025-13401

What is CVE-2025-13401?

The Autoptimize plugin for WordPress suffers from a stored cross-site scripting vulnerability due to inadequate input sanitization and output escaping. This vulnerability exists in the 'create_img_preload_tag' function, affecting all versions up to and including 3.1.13. Authenticated attackers with contributor-level access or higher can exploit this flaw to inject arbitrary web scripts into pages. Once injected, these scripts execute in the browsers of users who access those compromised pages, potentially leading to data theft, session hijacking, or further exploitation.

References