cleantalk
Vulnerabilities and Security Researches

Vulnerabilities and security researches forautoptimize autoptimize

Direction: ascending
Jun 07, 2024

Autoptimize # CVE-2021-24332

CVE, Research URL

CVE-2021-24332

Application

Autoptimize

Date
May 24, 2021
Research Description
The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues
Affected versions
max 2.8.4.
Status
vulnerable

Autoptimize # CVE-2020-24948

CVE, Research URL

CVE-2020-24948

Application

Autoptimize

Date
Sep 03, 2020
Research Description
The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.
Affected versions
max 2.7.7.
Status
vulnerable

Autoptimize # CVE-2022-2635

CVE, Research URL

CVE-2022-2635

Application

Autoptimize

Date
Sep 16, 2022
Research Description
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
Affected versions
max 3.1.1.
Status
vulnerable

Autoptimize # CVE-2022-4057

CVE, Research URL

CVE-2022-4057

Application

Autoptimize

Date
Jan 03, 2023
Research Description
The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.
Affected versions
max 3.1.0.
Status
vulnerable

Autoptimize # CVE-2021-24378

CVE, Research URL

CVE-2021-24378

Application

Autoptimize

Date
Jun 22, 2021
Research Description
The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.
Affected versions
max 2.7.8.
Status
vulnerable

Autoptimize # CVE-2021-24377

CVE, Research URL

CVE-2021-24377

Application

Autoptimize

Date
Jun 22, 2021
Research Description
The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.
Affected versions
max 2.7.8.
Status
vulnerable

Autoptimize # CVE-2023-2113

CVE, Research URL

CVE-2023-2113

Application

Autoptimize

Date
May 30, 2023
Research Description
The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.
Affected versions
max 3.1.7.
Status
vulnerable

Autoptimize # CVE-2021-24376

CVE, Research URL

CVE-2021-24376

Application

Autoptimize

Date
Jun 22, 2021
Research Description
The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the "Import Settings" functionality to achieve Remote Code Execution.
Affected versions
max 2.7.8.
Status
vulnerable
Apr 15, 2025

Autoptimize # PSC-2025-64563

PSC, Research URL

PSC-2025-64563

Application

Autoptimize

Date
Apr 15, 2025
Research Description
Autoptimize 3.1.13 is a high-performance optimization plugin for WordPress designed to dramatically speed up your website. By aggregating, minifying, and caching JavaScript, CSS, and HTML code, the plugin ensures leaner and faster page loads. It also enhances performance by inlining critical CSS, deferring script execution, and supporting modern image formats like WebP and AVIF. Built with flexibility and extensibility in mind, Autoptimize provides a robust API, enabling developers to fine-tune optimizations based on specific site requirements. With Autoptimize Pro, users can access premium features such as image CDN, page caching, critical CSS automation, and more. Autoptimize has undergone rigorous code review and security testing, achieving the Plugin Security Certification (PSC-2025-64563) from CleanTalk, ensuring peace of mind for site owners and developers who prioritize security.
Affected versions
Min 3.1.15.1, max 3.1.15.1.
Status
SAFE & CERTIFIED
Jan 09, 2026

Autoptimize # CVE-2025-13401

CVE, Research URL

CVE-2025-13401

Application

Autoptimize

Date
Dec 03, 2025
Research Description
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the "create_img_preload_tag" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions
max 3.1.14.
Status
vulnerable
Apr 14, 2026

Autoptimize # CVE-2026-2430

CVE, Research URL

CVE-2026-2430

Application

Autoptimize

Date
Mar 21, 2026
Research Description
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the `add_lazyload` function that replaces all occurrences of `\ssrc=` in image tags without limiting to the actual attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by crafting an image tag where the `src` URL contains a space followed by `src=`, causing the regex to break the HTML structure and promote text inside attribute values into executable HTML attributes.
Affected versions
max 3.1.15.
Status
vulnerable

Autoptimize # CVE-2026-2352

CVE, Research URL

CVE-2026-2352

Application

Autoptimize

Date
Mar 21, 2026
Research Description
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the "Image optimization" or "Lazy-load images" setting is enabled in the plugin configuration.
Affected versions
max 3.1.15.
Status
vulnerable
May 19, 2026

Autoptimize # CVE-2026-3220

CVE, Research URL

CVE-2026-3220

Application

Autoptimize

Date
May 18, 2026
Research Description
The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
Affected versions
max 3.1.15.
Status
vulnerable
Jun 16, 2026

Autoptimize # 959292096b267d9ffa55ee513be2fcd1d57400dc

Application

Autoptimize

Date
Apr 23, 2023
Research Description
Autoptimize [autoptimize] < 3.1.7 WordPress Autoptimize Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS) Update the WordPress Autoptimize plugin to the latest available version (at least 3.1.7). An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Autoptimize Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.1.7.
Affected versions
max 3.1.7.
Status
vulnerable

Autoptimize # 40af50fc504c00e8121d51aba499eaee861e5f0e

Application

Autoptimize

Date
May 04, 2021
Research Description
Autoptimize [autoptimize] < 2.8.4 WordPress Autoptimize plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by m0ze in WordPress Autoptimize plugin (versions <= 2.8.3).
Affected versions
max 2.8.4.
Status
vulnerable

Autoptimize # e9d5f4af6b383424239e7d4a7d2561b798d4c6a3

Application

Autoptimize

Date
-
Research Description
Autoptimize [autoptimize] < 3.1.0 WordPress Autoptimize Plugin <= 3.0.4 is vulnerable to Sensitive Data Exposure Update the WordPress Autoptimize plugin to the latest available version (at least 3.1.0). Raad Haddad (Cloudyrion GmbH) discovered and reported this Sensitive Data Exposure vulnerability in WordPress Autoptimize Plugin. This vulnerability has been fixed in version 3.1.0.
Affected versions
max 3.1.0.
Status
vulnerable

Autoptimize # 5702d8bb28f9b76b26ac5e940389264b6751a3e6

Application

Autoptimize

Date
Apr 25, 2023
Research Description
Autoptimize [autoptimize] < 3.1.7 WordPress Autoptimize Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS) Update the WordPress Autoptimize plugin to the latest available version (at least 3.1.7). An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Autoptimize Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.1.7.
Affected versions
max 3.1.7.
Status
vulnerable

Autoptimize # 4c9457a43e483bbaa2b79f105f07221d22529f4d

Application

Autoptimize

Date
Jun 19, 2017
Research Description
Autoptimize [autoptimize] < 2.1.1 Autoptimize <= 2.1.0 - Unauthenticated Local File Inclusion The Autoptimize plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.0. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This requires both JS and CSS aggregation, and the 'Also aggregate inline CSS' option to be set.
Affected versions
max 2.1.1.
Status
vulnerable