Lws Optimize CVEs and Security Vulnerabilities

CVE-2026-16042

LWS Optimize < 3.4 - Subscriber+ Cache Deletion

The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Subscribers, to flush the site's caches and force repeated cache rebuilds.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Lws Optimize

CVE-2026-16032

LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring

The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed