CVE-2026-78471

12th percentile - higher than 12% of all known CVEs

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to and including 3.1.15.1 due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled Autoptimize's 'Lazy-load images?' option, the w3-total-cache/w3-total-cache.php file to be present on disk with the plugin disabled, a class named Minify_HTML to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator before the payload renders.

An attacker can steal user data, hijack sessions, or inject malicious code into pages, potentially leading to security breaches and loss of trust.

Update the Autoptimize plugin to the latest patched version. Additionally, consider disabling the 'Lazy-load images?' option if not necessary, and regularly moderate comments.