Autoptimize

Autoptimize has 13 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; all 13 are fixed as of September 2026. Their average CVSS score is 6.7, and the most serious one scores 9.8 out of 10. Severity breakdown: 2 critical and 3 high. 2020 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 8 of the records (62%). Other recurring categories include Unrestricted Upload Of File With Dangerous Type, Exposure Of Sensitive Information To An Unauthorized Actor.

Every one of the 13 issues recorded for Autoptimize has a vendor fix available, so running the current release closes all known holes.

9 independent researchers contributed these findings, most of them (3) reported by Marcin Węgłowski. Autoptimize is installed on roughly 800,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.7/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Autoptimize vulnerabilities before they are exploited.

Highest severity on recordCVSS 9.8CVE-2021-24376

Autoptimize <= 2.7.7 - Arbitrary File Upload (and Remote Code Execution) via Import Settings

Read the full analysis

Vulnerability Records

13 records


2026-04-27 00:00	Multiple Plugins <= Multiple Versions - Unauthenticated Stored Cross-Site Scripting Autoptimize < 3.1.15	`CVE-2026-3220`	7.2 High	stealthcopter	Yes
2026-03-20 00:00	Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'ao_post_preload' Meta Value Autoptimize <= 3.1.14	`CVE-2026-2352`	6.4 Medium	bashu	Yes
2026-03-20 00:00	Autoptimize <= 3.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy-loaded Image Attributes Autoptimize <= 3.1.14	`CVE-2026-2430`	6.4 Medium	stealthcopter	Yes
2025-12-03 00:32	Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting Autoptimize <= 3.1.13	`CVE-2025-13401`	6.4 Medium	Muhammad Yudha - DJ	Yes
2023-04-25 00:00	Autoptimize <= 3.1.6 - Authenticated (Admin+) Stored Cross-Site Scripting via Critical CSS Rules Autoptimize <= 3.1.6	`CVE-2023-2113`	4.4 Medium	Juampa Rodríguez	Yes
2022-12-05 00:00	Autoptimize <= 3.0.4 - Sensitive Information Disclosure Autoptimize <= 3.0.4	`CVE-2022-4057`	5.3 Medium	Raad Haddad	Yes
2022-07-19 00:00	Autoptimize <= 3.1.0 - Authenticated (Admin+) Stored Cross-Site Scripting via Critical CSS Settings Autoptimize <= 3.1.0	`CVE-2022-2635`	5.5 Medium	Raad Haddad	Yes
2021-05-07 00:00	Autoptimize <= 2.8.3 - Stored Cross-Site Scripting Autoptimize < 2.8.4	`CVE-2021-24332`	5.5 Medium	R3N0	Yes
2020-10-09 00:00	Autoptimize <= 2.7.7 - Arbitrary File Upload (and Remote Code Execution) via Import Settings Autoptimize < 2.7.8	`CVE-2021-24376`	9.8 Critical	Marcin Węgłowski	Yes
2020-10-09 00:00	Autoptimize <= 2.7.7 - Unsafe File Upload to Cross-Site Scripting Autoptimize < 2.7.8	`CVE-2021-24378`	4.8 Medium	Marcin Węgłowski	Yes

Showing 1–10 of 13 reports

Latestv3.1.15.1

Autoptimize

Author

Optimizing Matters

4.7(1,428)

94/100

Last Updated

2026-08-20 (23d ago)

Active Installs

800,000+

Downloads

44,227,075

Requires WP

5.3+

Requires PHP

7.1+

Tested up to

WP 7.1

Created

2009-07-09 (17y ago)

Autoptimize makes optimizing your site really easy. It can aggregate, minify and cache scripts and styles, injects CSS in the page head by default but can also inline critical CSS and defer the aggregated full CSS, moves and defers scripts to the footer and minifies HTML. You can optimize and lazy-load images (with support for WebP and AVIF formats), optimize Google Fonts, async non-aggregated JavaScript, remove WordPress core emoji cruft and more. As such it can improve your site’s performance even when already on HTTP/2! There is extensive API available to enable you to tailor Autoptimize to each and every site’s specific needs. If you think performance indeed is important, you should at least consider one of the many free page caching plugins (e.g. Speed Booster pack or KeyCDN’s Cache Enabler) to complement Autoptimize or even consider Autoptimize Pro which not only has page caching but also image optimization, CDN, critical CSS and more! Autoptimize Pro Autoptimize Pro is a premium Power-Up, adding image optimization, CDN, page caching, automatic critical CSS rules and extra “booster” options, all in one handy subscription to make your site even faster!! Premium Support We provide great Premium Support and Web Performance Optimization services with Accelera, check out our offering on https://accelerawp.com/! (Speed-surfing image under creative commons by LL Twistiti)

View on WordPress.org