Security Alert Summary
The Autoptimize plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its lazy-loading image processing. An overly permissive regular expression used by the plugin can be abused by authenticated users with Contributor-level access or higher to inject scripts that execute when an injected page is viewed.
CVE Details
- CVE ID: CVE-2026-2430
- Affected component: Autoptimize plugin for WordPress
- Affected versions: All versions up to, and including, 3.1.14
- Published: March 21, 2026 12:16 AM UTC
- Last modified: March 21, 2026 12:16 AM UTC
- CVSS v3.1: Base Score 6.4, Medium —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / Privileges / User interaction: Authentication required (authenticated users). Privileges required: Low (Contributor-level access and above). User interaction: None.
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- CWE: CWE-79 (Cross-site Scripting)
Technical Details
This is a stored cross-site scripting issue in the plugin’s lazy-loading image processing. The vulnerability exists because the add_lazyload function uses an overly permissive regular expression that replaces occurrences of \ssrc= in image tags without ensuring the replacement is limited to the actual src attribute. An authenticated attacker with Contributor-level access or higher can craft an image tag whose src URL contains a space followed by src=. When the permissive regex operates on that input it can break the surrounding HTML structure and cause text that was inside attribute values to be interpreted as executable HTML attributes, allowing arbitrary script injection that is stored in the CMS and executed when a user loads the injected page.
The description identifies the problematic function by name (add_lazyload) and the specific matching pattern (\ssrc=) as the root cause. The impact is limited to pages where an attacker can store crafted content; it does not indicate privilege escalation beyond the ability to inject content or direct server-side code execution.
How This Could Impact Your Website
In a multi-user WordPress environment a contributor or other authenticated user with the required privileges could add or edit content (for example, a post or page) to include a specially crafted image tag that triggers the stored XSS. When staff, contractors, or site visitors view the affected page, the injected script can run in their browsers. Practical consequences include the ability to modify what the user sees, steal session-based data accessible to the browser, or inject deceptive content used for targeted phishing or social engineering against internal users.
For example, an external contractor or a trusted contributor could inadvertently or intentionally post content that executes scripts in the context of site viewers, increasing the risk that internal staff email addresses and session information could be exposed to further targeted attacks. The vulnerability’s CVSS impacts are rated as Low for confidentiality and integrity and None for availability, so the likely outcomes are limited to client-side script execution and data exposure rather than full site takeover.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributors.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and content changes for unusual behavior or unexpected script injections.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://github.com/futtta/autoptimize/commit/a0f87112fe80b5a97b036229c41cb18454392858
- https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L987
- https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeImages.php#L987
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3482530%40autoptimize&new=3482530%40autoptimize&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc5c4d7-09dc-45bf-a3c7-5a0757e3110a?source=cve
