The LWS Optimize WordPress plugin versions prior to 4.1.2 contain a CWE-79 Cross-Site Scripting vulnerability. An unauthenticated attacker can submit malicious script code through an analytics endpoint that is not properly escaped before being stored and displayed in the administrative dashboard. When an administrator accesses this dashboard page, the injected script executes in their browser context, potentially leading to session hijacking or other script-based attacks. No CVSS score or vendor remediation information is currently available.

An unauthenticated attacker can inject and execute arbitrary scripts in the context of an administrator's browser when they view the affected dashboard page. This can lead to administrative session compromise or other malicious actions performed with administrator privileges. The vulnerability affects the confidentiality and integrity of the administrative interface.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the administrative dashboard and monitor for suspicious activity. Avoid using affected versions of the plugin if possible.