Vulnerabilities and security researches forautoptimize autoptimize
Direction: ascendingJun 07, 2024
Autoptimize # CVE-2021-24332
- CVE, Research URL
- Home page URL
- Application
- Date
- May 24, 2021
- Research Description
- The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues
- Affected versions
-
max 2.8.4.
- Status
-
vulnerable
Autoptimize # CVE-2020-24948
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 03, 2020
- Research Description
- The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrary files, such as PHP, leading to remote command execution.
- Affected versions
-
max 2.7.7.
- Status
-
vulnerable
Autoptimize # CVE-2022-2635
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 16, 2022
- Research Description
- The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Affected versions
-
max 3.1.1.
- Status
-
vulnerable
Autoptimize # CVE-2022-4057
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 03, 2023
- Research Description
- The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs.
- Affected versions
-
max 3.1.0.
- Status
-
vulnerable
Autoptimize # CVE-2021-24378
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 22, 2021
- Research Description
- The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possible for a high privilege user to upload a malicious file containing JavaScript code inside an archive which will execute when a victim visits index.html inside the plugin directory.
- Affected versions
-
max 2.7.8.
- Status
-
vulnerable
Autoptimize # CVE-2021-24377
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 22, 2021
- Research Description
- The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is not sufficient to protect against RCE as a race condition can be achieved in between the moment the file is extracted on the disk but not yet removed. It is a bypass of CVE-2020-24948.
- Affected versions
-
max 2.7.8.
- Status
-
vulnerable
Autoptimize # CVE-2023-2113
- CVE, Research URL
- Home page URL
- Application
- Date
- May 30, 2023
- Research Description
- The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.
- Affected versions
-
max 3.1.7.
- Status
-
vulnerable
Autoptimize # CVE-2021-24376
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 22, 2021
- Research Description
- The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. However, the extracted folders are not checked and it is possible to upload a zip which contained a directory with PHP file in it and then it is not removed from the disk. It is a bypass of CVE-2020-24948 which allows sending a PHP file via the "Import Settings" functionality to achieve Remote Code Execution.
- Affected versions
-
max 2.7.8.
- Status
-
vulnerable
Apr 15, 2025
Autoptimize # PSC-2025-64563
- PSC, Research URL
- Home page URL
- Application
- Date
- Apr 15, 2025
- Research Description
- Autoptimize 3.1.13 is a high-performance optimization plugin for WordPress designed to dramatically speed up your website. By aggregating, minifying, and caching JavaScript, CSS, and HTML code, the plugin ensures leaner and faster page loads. It also enhances performance by inlining critical CSS, deferring script execution, and supporting modern image formats like WebP and AVIF. Built with flexibility and extensibility in mind, Autoptimize provides a robust API, enabling developers to fine-tune optimizations based on specific site requirements. With Autoptimize Pro, users can access premium features such as image CDN, page caching, critical CSS automation, and more. Autoptimize has undergone rigorous code review and security testing, achieving the Plugin Security Certification (PSC-2025-64563) from CleanTalk, ensuring peace of mind for site owners and developers who prioritize security.
- Affected versions
-
Min 3.1.15.1, max 3.1.15.1.
- Status
-
SAFE & CERTIFIED
Jan 09, 2026
Autoptimize # CVE-2025-13401
- CVE, Research URL
- Home page URL
- Application
- Date
- Dec 03, 2025
- Research Description
- The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the "create_img_preload_tag" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 3.1.14.
- Status
-
vulnerable
Apr 14, 2026
Autoptimize # CVE-2026-2430
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 21, 2026
- Research Description
- The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the `add_lazyload` function that replaces all occurrences of `\ssrc=` in image tags without limiting to the actual attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by crafting an image tag where the `src` URL contains a space followed by `src=`, causing the regex to break the HTML structure and promote text inside attribute values into executable HTML attributes.
- Affected versions
-
max 3.1.15.
- Status
-
vulnerable
Autoptimize # CVE-2026-2352
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 21, 2026
- Research Description
- The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ao_post_preload' meta value in all versions up to, and including, 3.1.14. This is due to insufficient input sanitization in the `ao_metabox_save()` function and missing output escaping when the value is rendered into a `<link>` tag in `autoptimizeImages.php`. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, granted the "Image optimization" or "Lazy-load images" setting is enabled in the plugin configuration.
- Affected versions
-
max 3.1.15.
- Status
-
vulnerable
May 19, 2026
Autoptimize # CVE-2026-3220
- CVE, Research URL
- Home page URL
- Application
- Date
- May 18, 2026
- Research Description
- The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
- Affected versions
-
max 3.1.15.
- Status
-
vulnerable
Jun 16, 2026
Autoptimize # 959292096b267d9ffa55ee513be2fcd1d57400dc
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 23, 2023
- Research Description
- Autoptimize [autoptimize] < 3.1.7 WordPress Autoptimize Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS) Update the WordPress Autoptimize plugin to the latest available version (at least 3.1.7). An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Autoptimize Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.1.7.
- Affected versions
-
max 3.1.7.
- Status
-
vulnerable
Autoptimize # 40af50fc504c00e8121d51aba499eaee861e5f0e
- CVE, Research URL
- Home page URL
- Application
- Date
- May 04, 2021
- Research Description
- Autoptimize [autoptimize] < 2.8.4 WordPress Autoptimize plugin <= 2.8.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by m0ze in WordPress Autoptimize plugin (versions <= 2.8.3).
- Affected versions
-
max 2.8.4.
- Status
-
vulnerable
Autoptimize # e9d5f4af6b383424239e7d4a7d2561b798d4c6a3
- CVE, Research URL
- Home page URL
- Application
- Date
- -
- Research Description
- Autoptimize [autoptimize] < 3.1.0 WordPress Autoptimize Plugin <= 3.0.4 is vulnerable to Sensitive Data Exposure Update the WordPress Autoptimize plugin to the latest available version (at least 3.1.0). Raad Haddad (Cloudyrion GmbH) discovered and reported this Sensitive Data Exposure vulnerability in WordPress Autoptimize Plugin. This vulnerability has been fixed in version 3.1.0.
- Affected versions
-
max 3.1.0.
- Status
-
vulnerable
Autoptimize # 5702d8bb28f9b76b26ac5e940389264b6751a3e6
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 25, 2023
- Research Description
- Autoptimize [autoptimize] < 3.1.7 WordPress Autoptimize Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS) Update the WordPress Autoptimize plugin to the latest available version (at least 3.1.7). An unknown person discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Autoptimize Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 3.1.7.
- Affected versions
-
max 3.1.7.
- Status
-
vulnerable
Autoptimize # 4c9457a43e483bbaa2b79f105f07221d22529f4d
- CVE, Research URL
- Home page URL
- Application
- Date
- Jun 19, 2017
- Research Description
- Autoptimize [autoptimize] < 2.1.1 Autoptimize <= 2.1.0 - Unauthenticated Local File Inclusion The Autoptimize plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.1.0. This allows unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included. This requires both JS and CSS aggregation, and the 'Also aggregate inline CSS' option to be set.
- Affected versions
-
max 2.1.1.
- Status
-
vulnerable