CVE-2021-24332: vulnerability in Autoptimize
Autoptimize < 2.8.4 - Authenticated Stored Cross-Site Scripting (XSS)
Published · Updated
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackepss 0.6%
exploitation probability
0.6%top 52% of all CVEs
observed exploitation
nono source reports it
The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leading to stored Cross-Site Scripting issues
Affected products
Unknown · AutoptimizeRelated CVEs — Autoptimize
In the same product, most dangerous first.
CVE-2021-24376—Autoptimize < 2.7.8 - Arbitrary File Upload via "Import Settings"EPSS 3.7%CVE-2022-4057MEDIUMAutoptimize < 3.1.0 - Sensitive Data DisclosureEPSS 1.5%CVE-2021-24377—Autoptimize < 2.7.8 - Race Condition leading to RCEEPSS 1.2%CVE-2022-2635—Autoptimize < 3.1.1 - Admin+ Stored Cross Site ScriptingEPSS 0.6%CVE-2021-24378—Autoptimize < 2.7.8 - Authenticated Stored XSS via File UploadEPSS 0.6%CVE-2023-2113MEDIUMAutoptimize < 3.1.7 - Admin+ Stored Cross-Site Scripting via Settings ImportEPSS 0.5%