VULNERABILITY INTELLIGENCE
CVE-2026-16032
CVSS score6.1 MEDIUM
EPSS probability0.27%
CISA KEVNot currently listed
Published2026-08-09
Last modified2026-08-26
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Description
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79