The Autoptimize plugin for WordPress is vulnerable to Stored Cross‑Site Scripting because it fails to sanitize the "ao_post_preload" meta value and does not escape it when rendering a <link> tag. Authenticated users with Contributor level access or higher can inject arbitrary JavaScript that will run in the browser when any visitor loads a page that includes the injected value. This attack can compromise the confidentiality, integrity, and availability of the affected website’s data and user sessions. The weakness is a classic input validation flaw (CWE‑79).

WordPress sites that use the Autoptimize plugin version 3.1.14 or earlier are affected. The vulnerability exists in all releases up to and including 3.1.14. Any site with the plugin installed and configured for "Image optimization" or "Lazy‑load images" is at risk.

The CVSS score of 6.4 indicates a moderate severity. EPSS and KEV information are not available, so the likelihood of widespread exploitation cannot be quantified, but the vulnerability requires only Contributor‑level credentials, which many sites grant to content editors. Because the attacker’s injected script runs in the context of the site’s pages, the impact can be severe, especially if the site handles sensitive user data. Sites that have disabled the affected plugin or its image optimization features will not be vulnerable. However, sites enabled for image optimization or lazy‑loading remain at risk until mitigated.