CVE-2026-16032

Name of the Vulnerable Software and Affected Versions LWS Optimize versions prior to 4.1.2

Description An issue exists where a value submitted through an unauthenticated analytics endpoint is not properly escaped before being stored and rendered in an administrative dashboard. This allows unauthenticated attackers to perform a Stored Cross-Site Scripting (XSS) attack—a technique where malicious scripts are permanently stored on the target server—which execute when an administrator views the affected dashboard page.

Recommendations Update LWS Optimize to version 4.1.2 or later.