Autoptimize <= 3.1.15.1 - Unauthenticated Stored Cross-Site Scripting via Comment Author Name

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-78471 · Microsoft / collected KEV context

cve-program · CVE-2026-78471

• https://www.wordfence.com/threat-intel/vulnerabilities/id/b14f574d-1490-423e-9ef3-ce8f844cb8f0?source=cve
• https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeImages.php#L1232
• https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeImages.php#L960
• https://plugins.trac.wordpress.org/browser/autoptimize/tags/3.1.15.1/classes/autoptimizeImages.php#L908
• https://plugins.trac.wordpress.org/changeset?reponame=&new=3713884%40autoptimize%2Ftags%2F3.1.16&old=3657650%40autoptimize%2Ftags%2F3.1.15.1
• https://plugins.trac.wordpress.org/changeset/3713884/autoptimize/trunk/classes/autoptimizeImages.php

No related operational record is retained in the current change model.