The LWS Optimize WordPress plugin versions prior to 4.1.2 contain a CWE-79 Cross-Site Scripting vulnerability. An unauthenticated attacker can submit crafted input via an analytics endpoint that is not properly escaped before being stored and rendered in the administrative dashboard. When an administrator accesses this dashboard page, the injected scripts execute in their browser context, potentially leading to information disclosure or session hijacking. The vulnerability is network exploitable without privileges and requires user interaction (administrator viewing the dashboard).

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of an administrator's browser when they view the affected dashboard page. This can lead to limited confidentiality and integrity impacts, such as theft of administrator session tokens or manipulation of dashboard content. There is no direct availability impact reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, administrators should monitor for updates from the LWS Optimize plugin vendor and apply any released patches promptly. Until then, restricting access to the administrative dashboard and limiting exposure of the analytics endpoint may reduce risk.