The LWS Optimize WordPress plugin before version 4.1.2 fails to properly escape user-supplied data sent to an unauthenticated analytics endpoint. The unsanitized value is stored and later rendered in an administrative dashboard, allowing an attacker to inject malicious scripts that run when a site administrator views the dashboard. This flaw provides a means for code execution within the privileged context of the admin interface, potentially leading to session hijacking, credential theft, or further compromise of the WordPress installation.

All WordPress installations that have the LWS Optimize plugin installed with a version older than 4.1.2 are affected. The plugin is distributed by an unidentified vendor under the name "LWS Optimize."

The vulnerability is remotely exploitable via unauthenticated HTTP requests to the analytics endpoint; the attacker only needs to send crafted data to be stored. While an EPSS score is not available, the lack of authentication checks and the severity of stored XSS suggest a high risk of exploitation. The issue is not listed in CISA KEV, but the potential impact of executing scripts in an admin session warrants urgent attention.