LWS Optimize vulnerabilities

The LWS Optimize WordPress plugin before version 4.1.2 improperly escapes a value submitted through an unauthenticated analytics endpoint before storing and rendering it in the admin dashboard. This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.

The LWS Optimize WordPress plugin before version 3.4 does not perform a capability check on its cache-clearing actions. Any authenticated user, including Subscribers, can flush the site's caches and force repeated cache rebuilds.

The LWS Optimize plugin for WordPress up to version 3.3.19 is vulnerable to arbitrary file read. The combine_current_css() function trusts href values from <link> tags in page HTML and converts same-site URLs to absolute filesystem paths before reading them without verifying that the path stays within ABSPATH or has a .css extension. This allows authenticated attackers with Editor-level access and above to read arbitrary files.