CVE-2026-78471: Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name
The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.1.15.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires an administrator to have enabled Autoptimize's 'Lazy-load images?' option, the w3-total-cache/w3-total-cache.php file to be present on disk with the plugin disabled, a class named MinifyHTML to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator before the payload renders.
Affected Software
Event History
Frequently Asked Questions
What conditions must be present for exploitation to succeed?
Autoptimize’s “Lazy-load images?” option must be enabled. The w3-total-cache/w3-total-cache.php file must exist on disk while that plugin is disabled, another plugin must have loaded a class named Minify_HTML, and a moderator must approve the attacker’s malicious comment.
Does an attacker need an account or user interaction to inject the payload?
No account is required to submit the malicious comment. However, a moderator must approve it, and the script executes only when someone later accesses the page containing the approved comment.
Who is affected when the payload executes?
Any user who accesses the page containing the injected, approved comment may execute the attacker’s script in their browser. The vulnerability can affect confidentiality and integrity, but no availability impact is indicated.
How can I assess whether my site is exposed?
Check whether Autoptimize is version 3.1.15.1 or earlier, whether “Lazy-load images?” is enabled, whether w3-total-cache/w3-total-cache.php remains on disk while W3 Total Cache is disabled, and whether another active plugin loads the Minify_HTML class. Also review approved comments for suspicious author-name content.