Stored Cross-Site Scripting Vulnerability in Autoptimize Plugin for WordPress

CVE-2026-78471

What is CVE-2026-78471?

The Autoptimize plugin for WordPress has a vulnerability that allows unauthenticated attackers to execute arbitrary web scripts through insufficient input sanitization and output escaping in the Comment Author Name field. This risk is present in all versions up to and including 3.1.15.1. For exploitation, certain conditions must be met: the Autoptimize plugin must have the 'Lazy-load images?' option enabled, the w3-total-cache/w3-total-cache.php file must be available with the plugin disabled, and another plugin must have loaded a class named Minify_HTML. Additionally, the malicious comment must be approved by a moderator for the script to execute successfully on the targeted pages.

References