Stored Cross-Site Scripting Vulnerability in AAA Autoload Optimizer Plugin for WordPress

CVE-2026-119211

What is CVE-2026-119211?

The AAA Autoload Optimizer plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting through the 'option_page' parameter due to inadequate input sanitization and output escaping. This flaw affects all versions up to and including 1.7.0 and can be exploited by authenticated attackers with subscriber-level access or higher. When the plugin's Option Tracking setting is set to 'Legacy' mode, attackers can inject arbitrary scripts that execute when users access compromised pages. This vulnerability remains exploitable even if WordPress returns an HTTP 403 response to low-privileged users, as the exploitable filter is processed before the capability checks in the wp-admin/options.php file.

References