The Autoptimize WordPress plugin (prior to version 3.1.15) contains a stored XSS vulnerability due to the use of a predictable placeholder hash during HTML minification and a flawed regular expression. Attackers can exploit this by injecting arbitrary HTML attributes into the final rendered HTML, potentially leading to script execution in users' browsers. This vulnerability is unauthenticated, meaning no login is required to exploit it. Similar issues affect Clearfy Cache and Speed Optimizer WordPress plugins in specified versions. No CVSS score or official remediation guidance is currently available.

Successful exploitation allows an unauthenticated attacker to inject arbitrary HTML attributes into the final HTML output, which can lead to stored Cross-Site Scripting attacks. This may result in the execution of malicious scripts in the context of users visiting the affected site, potentially compromising user sessions, redirecting users, or performing other malicious actions within the browser.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch information is provided, users should monitor the Autoptimize plugin's official channels for updates and apply any released patches promptly. Until a fix is available, consider disabling the plugin or limiting its use to trusted environments to reduce exposure.