CVE-2026-16032
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The LWS Optimize WordPress plugin before version 4.1.2 improperly escapes a value submitted through an unauthenticated analytics endpoint before storing and rendering it in the admin dashboard. This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
Risk Assessment
The risk involves the execution of malicious scripts in the context of an administrator session, potentially leading to data theft, account takeover, or further site compromise.
Recommendation
Immediately update the LWS Optimize plugin to version 4.1.2 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.