CVE-2026-2430

The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-loading image processing in all versions up to, and including, 3.1.14. This is due to the use of an overly permissive regular expression in the `add_lazyload` function that replaces all occurrences of `\ssrc=` in image tags without limiting to the actual attribute. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page by crafting an image tag where the `src` URL contains a space followed by `src=`, causing the regex to break the HTML structure and promote text inside attribute values into executable HTML attributes.

• CWE-79

• https://github.com/futtta/autoptimize/commit/a0f87112fe80b5a97b036229c41cb18454392858
• https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.14/classes/autoptimizeImages.php#L987
• https://plugins.trac.wordpress.org/browser/autoptimize/trunk/classes/autoptimizeImages.php#L987
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3482530%40autoptimize&new=3482530%40autoptimize&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/ddc5c4d7-09dc-45bf-a3c7-5a0757e3110a?source=cve

Published

Mar 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-24293Null pointer dereference in Windows Ancillary Function Drive…7.8
• CVE-2026-24294Improper authentication in Windows SMB Server allows an auth…7.8
• CVE-2026-24295Concurrent execution using shared resource with improper syn…7
• CVE-2026-24296Concurrent execution using shared resource with improper syn…7
• CVE-2026-24297Concurrent execution using shared resource with improper syn…4.8
• CVE-2026-24299Improper neutralization of special elements used in a comman…5.3
• CVE-2026-24300Azure Front Door Elevation of Privilege Vulnerability9.8
• CVE-2026-24302Improper access control in Azure Arc allows an unauthorized …9.8
• CVE-2026-24303Improper access control in Microsoft Partner Center allows a…9.6
• CVE-2026-24304Improper access control in Azure Resource Manager allows an …9.9
• CVE-2026-24305Azure Entra ID Elevation of Privilege Vulnerability9.8
• CVE-2026-24306Improper access control in Azure Front Door (AFD) allows an …9.8