Autoptimize is a WordPress optimization plugin with a narrow footprint focused on a single widely deployed product, yet its vulnerabilities skew toward serious outcomes with a meaningful share reaching critical severity. The exposure centers on input-handling and file-upload weaknesses characteristic of web plugins—cross-site scripting, unrestricted file uploads, and race conditions in concurrent operations—which reflect the plugin's role in processing and caching user-generated content and server resources. Current exploitation activity and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Autoptimize over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-24376CRITICAL The Autoptimize WordPress plugin before 2.7.8 attempts to delete malicious files (such as .php) form the uploaded archive via the "Import Settings" feature, after its extraction. H | Jun 21, 2021 | 9.8 | 29 | NO | NO |
CVE-2020-24948HIGH The ao_ccss_import AJAX call in Autoptimize Wordpress Plugin 2.7.6 does not ensure that the file provided is a legitimate Zip file, allowing high privilege users to upload arbitrar | Sep 3, 2020 | 7.2 | 29 | NO | NO |
CVE-2021-24377HIGH The Autoptimize WordPress plugin before 2.7.8 attempts to remove potential malicious files from the extracted archive uploaded via the 'Import Settings' feature, however this is no | Jun 21, 2021 | 8.1 | 24 | NO | NO |
CVE-2022-2635MEDIUM The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site S | Sep 16, 2022 | 4.8 | 19 | NO | NO |
CVE-2021-24332MEDIUM The Autoptimize WordPress plugin before 2.8.4 was missing proper escaping and sanitisation in some of its settings, allowing high privilege users to set XSS payloads in them, leadi | May 24, 2021 | 4.8 | 19 | NO | NO |
CVE-2023-2113MEDIUM The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) t | May 30, 2023 | 4.8 | 18 | NO | NO |
CVE-2021-24378MEDIUM The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded via the 'Import Settings' feature. As a result, it is possibl | Jun 21, 2021 | 4.8 | 17 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Autoptimize.
Media articles that mention a CVE ID that affects a product developed by Autoptimize — matched by CVE ID, not by vendor name.