What’s Vulnerable › Vulnerabilities
CVE-2026-16032: LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-09 · updated 2026-08-26
- Weakness: CWE-79
Description
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
Affected products
- LWS Optimize: before 4.1.2 — fixed in 4.1.2
How to fix
Upgrade to a fixed version: LWS Optimize 4.1.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-16032 or the next vulnerability affects your stack