CVE-2026-119211

The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'option_page' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the plugin's Option Tracking setting to be configured to 'Legacy' mode, and succeeds despite WordPress ultimately returning HTTP 403 to the low-privileged caller because the vulnerable 'all' filter fires before the capability check in wp-admin/options.php.

• CWE-79

• https://plugins.trac.wordpress.org/browser/aaa-option-optimizer/tags/1.7.0/js/admin-script.js#L343
• https://plugins.trac.wordpress.org/browser/aaa-option-optimizer/tags/1.7.0/src/class-plugin.php#L119
• https://plugins.trac.wordpress.org/browser/aaa-option-optimizer/tags/1.7.0/src/class-rest.php#L563
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3779738%40aaa-option-optimizer&new=3779738%40aaa-option-optimizer
• https://www.wordfence.com/threat-intel/vulnerabilities/id/6b880e0d-491d-4464-902d-6e601dd7c315?source=cve

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-119206pypdf is a free and open-source pure-python PDF library. Pri…5.5
• CVE-2026-119207pypdf is a free and open-source pure-python PDF library. Pri…5.5
• CVE-2026-119208pypdf is a free and open-source pure-python PDF library. Pri…5.5
• CVE-2026-119209pypdf is a free and open-source pure-python PDF library. Pri…5.5
• CVE-2026-11921IBM Verify Identity Access containers may not apply manageme…9.1
• CVE-2026-119210MariaDB Connector/J is used to connect applications develope…5.9
• CVE-2026-119215Authorization Bypass Through User-Controlled Key vulnerabili…7.6
• CVE-2026-11922A vulnerability in zenml-io/zenml versions 0.57.0 through 0.…6.5
• CVE-2026-11923IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Ver…7.4
• CVE-2026-119249A malicious actor with access to the network could exploit a…7.5
• CVE-2026-11925Tanium addressed a User Interface (UI) Misrepresentation of …2.7
• CVE-2026-119250A malicious actor with local access and low privileges could…7.8