CVE-2026-78471

Name of the Vulnerable Software and Affected Versions Autoptimize versions prior to 3.1.15.2

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. Successful exploitation requires the 'Lazy-load images?' option to be enabled, the w3-total-cache/w3-total-cache.php file to be present on disk while the plugin is disabled, a Minify HTML class to be loaded into scope by another plugin, and the malicious comment to be approved by a moderator.

Recommendations Update Autoptimize to version 3.1.15.2 or later.