AAA Autoload Optimizer
AAA Autoload Optimizer has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of November 2026. Their average CVSS score is 4.9, and the most serious one scores 4.9 out of 10.
The most common weakness is Improper Neutralization Of Input During Web Page Generation, behind 1 of the records (100%).
The one issue recorded for AAA Autoload Optimizer has a vendor fix available, so running the current release closes it.
All of these findings were reported by Maciej Komorowski. AAA Autoload Optimizer is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.
CVE-2026-119211AAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hook
Read the full analysisVulnerability Records

AAA Autoload Optimizer
Author
Progress Planner
Every WordPress site loads dozens — sometimes hundreds — of autoloaded options from the wp_options table on every single page request. Many of those options belong to plugins you removed long ago, or simply don’t need to be autoloaded. The result: a bigger database query, slower page loads, and wasted server resources. AAA Autoload Optimizer tracks which autoloaded options your site actually uses, then shows you the ones it doesn’t — so you can safely remove them or turn off autoloading. How It Works Install the plugin and browse your site normally for a few days. The plugin quietly records which autoloaded options are actually used during page rendering. Visit the settings screen to see every autoloaded option that was never used — and decide what to do with it. You can remove unused options entirely (great for leftover data from deactivated plugins) or disable autoloading for options that exist but don’t need to load on every request. Disabling autoloading is non-destructive — the option stays in your database, it just won’t be fetched automatically. Features Automatic usage tracking — monitors which autoloaded options are loaded on every page, on both the front end and in the admin. Bulk actions — optimize or delete multiple options at once instead of one by one. Known-plugin recognition — identifies which plugin or theme each option belongs to, so you know exactly what you’re looking at. “All Options” browser — view and manage every option in your wp_options table, not just the unused ones. Source filtering — filter options by their source plugin, theme, or WordPress core to quickly find what you need. Safe by design — disabling autoload is non-destructive. You can always re-enable it. Lightweight — the plugin’s own tracking data is stored in a custom database table for optimal performance. Why the “aaa” Slug? WordPress loads plugins alphabetically. Because this plugin needs to start tracking options as early as possible, the aaa-option-optimizer slug ensures it loads first. It’s not vanity — it’s a technical requirement for accurate measurement. Links GitHub repository — report bugs, contribute code, or browse the source. Report a security vulnerability — via the Patchstack Vulnerability Disclosure Program. Built by the team behind Progress Planner.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C