Vulnerability · Published Aug 9, 2026 · Assigned by WPScan
CVE-2026-16032LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring
Medium 6.1
In plain English
A medium-severity cross-site scripting in LWS Optimize from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).
Severity (CVSS 3.1)6.1Medium
Exploit odds (30 days)0.3%top 80.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | LWS Optimize | 0 – before 4.1.2 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
- https://wpscan.com/vulnerability/f8520320-527b-4b30-9bac-f6e538154a40/ exploit, vdb-entry, technical-description