Stored Cross-Site Scripting in Autoptimize Plugin for WordPress

CVE-2026-2430

What is CVE-2026-2430?

The Autoptimize plugin for WordPress is subject to a Stored Cross-Site Scripting vulnerability due to an insecure lazy-loading image processing method present in all versions up to and including 3.1.14. This flaw arises from using an overly permissive regular expression in the add_lazyload function, which fails to properly validate attributes before modifying image tags. As a result, authenticated attackers with Contributor-level access or higher can exploit this vulnerability to inject arbitrary web scripts. This injection is possible by manipulating the src URL in image tags, wherein attackers can craft a payload that disrupts the HTML structure, elevating text within attribute values to executable HTML, thereby posing a significant risk to users when they load affected pages.

References