AAA Autoload Optimizer

AAA Autoload Optimizer has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of November 2026. Their average CVSS score is 4.9, and the most serious one scores 4.9 out of 10.

The most common weakness is Improper Neutralization Of Input During Web Page Generation, behind 1 of the records (100%).

The one issue recorded for AAA Autoload Optimizer has a vendor fix available, so running the current release closes it.

All of these findings were reported by Maciej Komorowski. AAA Autoload Optimizer is installed on roughly 9,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.4.

Strategic Overview

Avg CVSSMedium
4.9/ 10
Patch Coverage100%
Open

0

Fixed

1

Get automatic notifications for all AAA Autoload Optimizer vulnerabilities before they are exploited.

Highest severity on recordCVSS 4.9CVE-2026-119211

AAA Autoload Optimizer <= 1.7.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'option_page' Parameter via 'all' Hook

Read the full analysis

Vulnerability Records

1 records
AAA Autoload Optimizer banner
Latestv1.7.1

AAA Autoload Optimizer

Progress Planner

Author

Progress Planner

4.6(25)
92/100
Last Updated
2026-11-02 (4d ago)
Active Installs
9,000+
Downloads
126,008
Requires WP
6.7+
Requires PHP
7.4+
Tested up to
WP 7.1.4
Created
2024-04-15 (3y ago)

Every WordPress site loads dozens — sometimes hundreds — of autoloaded options from the wp_options table on every single page request. Many of those options belong to plugins you removed long ago, or simply don’t need to be autoloaded. The result: a bigger database query, slower page loads, and wasted server resources. AAA Autoload Optimizer tracks which autoloaded options your site actually uses, then shows you the ones it doesn’t — so you can safely remove them or turn off autoloading. How It Works Install the plugin and browse your site normally for a few days. The plugin quietly records which autoloaded options are actually used during page rendering. Visit the settings screen to see every autoloaded option that was never used — and decide what to do with it. You can remove unused options entirely (great for leftover data from deactivated plugins) or disable autoloading for options that exist but don’t need to load on every request. Disabling autoloading is non-destructive — the option stays in your database, it just won’t be fetched automatically. Features Automatic usage tracking — monitors which autoloaded options are loaded on every page, on both the front end and in the admin. Bulk actions — optimize or delete multiple options at once instead of one by one. Known-plugin recognition — identifies which plugin or theme each option belongs to, so you know exactly what you’re looking at. “All Options” browser — view and manage every option in your wp_options table, not just the unused ones. Source filtering — filter options by their source plugin, theme, or WordPress core to quickly find what you need. Safe by design — disabling autoload is non-destructive. You can always re-enable it. Lightweight — the plugin’s own tracking data is stored in a custom database table for optimal performance. Why the “aaa” Slug? WordPress loads plugins alphabetically. Because this plugin needs to start tracking options as early as possible, the aaa-option-optimizer slug ensures it loads first. It’s not vanity — it’s a technical requirement for accurate measurement. Links GitHub repository — report bugs, contribute code, or browse the source. Report a security vulnerability — via the Patchstack Vulnerability Disclosure Program. Built by the team behind Progress Planner.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C