CVE-2026-16032: LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16032?
CVE-2026-16032 has a risk score of 54, indicating a moderate severity level.
How do I fix CVE-2026-16032?
To fix CVE-2026-16032, update the LWS Optimize plugin to version 4.1.2 or later.
What vulnerabilities does CVE-2026-16032 expose?
CVE-2026-16032 exposes the risk of unauthenticated stored cross-site scripting (XSS) attacks.
Who is affected by CVE-2026-16032?
All users of LWS Optimize versions before 4.1.2 are affected by CVE-2026-16032.
What is the exploit method for CVE-2026-16032?
The exploit method for CVE-2026-16032 involves injecting arbitrary web scripts through an unauthenticated analytics endpoint.