The Autoptimize WordPress plugin contains an overly permissive regular expression in its lazy‑loading image routine that indiscriminately replaces every occurrence of the string " src=" within image tags. When a user with Contributor access or higher crafts an image tag whose src URL contains a space followed by "src=", the regex corrupts the HTML structure, allowing arbitrary script content to be injected into authorisable pages. Once a victim visitor loads such a page, the injected script executes in their browser, enabling theft of session cookies, credential compromise, or other client‑side attacks. This is a classic stored cross‑site scripting vulnerability that affects only sites where the attacker can create or modify content, but can impact all users who view that content.

WordPress sites that have installed the Autoptimize plugin version 3.1.14 or earlier, provided the site allows users with Contributor or higher roles to add or edit media or posts. The vendor is "optimizingmatters:Autoptimize"; any installation of the affected plugin will be susceptible if the relevant content can be injected by an authenticated contributor. Administrators who restrict contributor access or disable lazy‑load features may reduce exposure, but the fundamental flaw remains until a patch is applied.

The vulnerability has a CVSS score of 6.4, indicating moderate severity. No EPSS score is available, and it is not listed in the CISA KEV catalog. Exploitation requires authenticated access with at least Contributor privileges, meaning the threat is limited to users who can add or edit content. Once such a user injects malicious code, the impact extends to all site visitors who access the compromised page. The attack vector is via crafted image URLs inserted into content, making the flaw relatively straightforward for an authorized user to use.