CVE-2022-2635: Autoptimize < 3.1.1 - Admin+ Stored Cross Site Scripting
The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed (for example in multisite setup)
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-2635?
CVE-2022-2635 has a high severity rating due to the potential for Stored Cross-Site Scripting attacks.
How do I fix CVE-2022-2635?
To fix CVE-2022-2635, update the Autoptimize WordPress plugin to version 3.1.1 or later.
What are the potential impacts of CVE-2022-2635?
CVE-2022-2635 allows high privilege users to execute Stored Cross-Site Scripting attacks that can compromise site integrity.
Who is affected by CVE-2022-2635?
Users of the Autoptimize WordPress plugin prior to version 3.1.1 are affected by CVE-2022-2635.
Is CVE-2022-2635 present in multisite setups?
Yes, CVE-2022-2635 can be exploited in multisite setups even with unfiltered_html capability disallowed.