The JCH Optimize WordPress plugin prior to version 6.0.1 fails to verify user permissions for an authenticated AJAX action that determines which internal task to execute. This oversight allows any logged‑in user—including subscribers—to trigger the task that imports arbitrary plugin settings and stores a script as part of the plugin configuration. When a site visitor or administrator loads the page, that script runs in the browser, giving the attacker client‑side code execution. This is a stored Cross‑Site Scripting flaw.

WordPress sites using the JCH Optimize plugin with a version earlier than 6.0.1 are affected. The vulnerability does not depend on any specific WordPress version beyond the presence of the plugin and the vulnerable task override. All users who can authenticate to the site and invoke the AJAX action (e.g., Subscribers) can exploit the issue.

The CVSS score of 8 indicates a high severity. The EPSS score of 0.00158 (≈0.16%) indicates a very low but non‑zero exploitation probability. The absence of a capability check means vulnerability is trivial to exploit once any authenticated account exists. Although not listed in the CISA KEV catalog, the stored script can persist across site sessions and affect any visitor or administrator who loads the affected page. Because the flaw only requires a valid authenticated session, any compromised user credential represents a significant attack vector.