Threats tagged 'ghsa-fcq7-9xcx-6xxw'

Autoptimize, a WordPress plugin, is vulnerable to stored Cross-Site Scripting (XSS) via the Comment Author Name field in all versions up to and including 3.1.15.1. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation requires multiple conditions: the 'Lazy-load images?' option enabled by an administrator, presence of the w3-total-cache.php file on disk (even if the plugin is disabled), a class named Minify_HTML loaded by another plugin, and approval of the malicious comment by a moderator. This vulnerability allows unauthenticated attackers to inject scripts that execute when users access the affected pages.