Skip to content
Sign in
6.1 Medium

CVE-2026-16032 The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated…

Description

The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.

Affected products and versions

Product Affected versions Fixed in
LWS Optimize 4.1 earliest → < 4.1.2 4.1.2

Other CVEs of LWS Optimize

The 2 CVEs of LWS Optimize →
CVE-2026-16042 The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions,… 4.3 Medium
Track this CVE