The AAA Autoload Optimizer plugin contains a stored XSS flaw that can be triggered by an authenticated user, from subscriber level and higher, who passes an arbitrary value in the option_page parameter. The flaw is exercised through the WordPress "all" filter hooked to the plugin, allowing the attacker to store malicious JavaScript that runs whenever a user visits an affected page. The injection succeeds only when the plugin’s Option Tracking is set to Legacy mode, and it is executed before WordPress performs its normal capability check, so the attacker can bypass the HTTP 403 response that would otherwise be returned.

WordPress sites that have the AAA Autoload Optimizer plugin installed with a version equal to or older than 1.7.0, regardless of additional plugins or themes. The plugin is provided by progressplanner and targets WordPress installations hosting the plugin.

The CVSS score of 4.9 places the vulnerability in a low to medium severity range, and the EPSS score is not available while the issue is not listed in CISA’s KEV catalog, indicating a current lower likelihood of widespread exploitation. However, because the flaw only requires subscriber‑level abuse and a specific plugin setting, any site that has granted that level of access to an attacker and left legacy mode enabled is potentially susceptible. An attacker who successfully injects code can deface pages or phish users, compromising the integrity and trustworthiness of the site.