WP-Safety
CVE-2026-2430

Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.4
CVSS Score
6.4
CVSS Score
medium
Severity
3.1.15
Patched in
1d
Time to patch

Description

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the `add_lazyload` function that replaces all occurrences of `\ssrc=` in image tags without limiting to the actual attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by crafting an image tag where the `src` URL contains a space followed by `src=`, causing the regex to break the HTML structure and promote text inside attribute values into executable HTML attributes.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=3.1.14
PublishedMarch 20, 2026
Last updatedMarch 20, 2026
Affected pluginautoptimize

What Changed in the Fix

Changes introduced in v3.1.15

Loading patch diff...

Source Code

WordPress.org SVN
Vulnerable v3.1.14
Browse source Download .zip
Patched v3.1.15
Browse source Download .zip
Research Plan
Unverified

# Exploitation Research Plan - CVE-2026-2430 ## 1. Vulnerability Summary The **Autoptimize** plugin (<= 3.1.14) is vulnerable to **Stored Cross-Site Scripting (XSS)**. The vulnerability resides in the `autoptimizeImages::add_lazyload` (or equivalent image processing) logic, where an overly permissi…

Show full research plan

Exploitation Research Plan - CVE-2026-2430

1. Vulnerability Summary

The Autoptimize plugin (<= 3.1.14) is vulnerable to Stored Cross-Site Scripting (XSS). The vulnerability resides in the autoptimizeImages::add_lazyload (or equivalent image processing) logic, where an overly permissive regular expression is used to identify and replace the src attribute of <img> tags for lazy loading.

The plugin incorrectly identifies strings like src= inside existing attribute values (e.g., within a URL query parameter) as the start of a new src attribute. When the plugin performs its replacement to inject a lazy-loading placeholder, it can inadvertently close the original attribute's quotes and "promote" the subsequent text into executable HTML attributes like onerror.

2. Attack Vector Analysis

  • Endpoint: WordPress Post/Page Editor (or any location where a Contributor+ can save HTML content).
  • Vulnerable Component: The lazy-loading image processor which runs on the frontend during page rendering.
  • HTTP Parameter: The content or post_content of a post.
  • Authentication: Required (Contributor-level or higher).
  • Preconditions:
    • The "Lazy-load images?" option must be enabled in Settings > Autoptimize > Images.
    • Alternatively, it can be enabled per-page via the Autoptimize Metabox (managed in `classes/autoptimizeMetab
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc5c4d7-09dc-45bf-a3c7-5a0757e3110a?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database