The LWS Optimize WordPress plugin before version 4.1.2 fails to properly escape user-supplied data sent to an unauthenticated analytics endpoint. The unsanitized value is stored and later rendered in an administrative dashboard, allowing an attacker to inject malicious scripts that run when a site administrator views the dashboard. This flaw provides a means for code execution within the privileged context of the admin interface, potentially leading to session hijacking, credential theft, or further compromise of the WordPress installation.

All WordPress installations that have the LWS Optimize plugin installed with a version older than 4.1.2 are affected. The plugin is distributed by an unidentified vendor under the name "LWS Optimize."

The vulnerability is remotely exploitable via unauthenticated HTTP requests to the analytics endpoint; the attacker only needs to send crafted data to be stored. The CVSS score of 6.1 indicates medium severity, and the EPSS score of less than 1% suggests a low probability of exploitation in the wild. Nevertheless, the lack of authentication checks and the ability to store malicious scripts in an administrative dashboard make this flaw a moderate to high risk for sites that have not applied the fix. The issue is not listed in CISA KEV, but the potential impact of executing scripts in an admin session warrants attention.