Vulnerabilities
CVE-2025-13401 - Autoptimize <= 3.1.13 - authenticated (contributor+) stored cross-site scripting
CVE ID : CVE-2025-13401 Published : Dec. 3, 2025, 1:52 p.m. | 29 minutes ago Description : The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the