CVE-2025-13401

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13401", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-19T10:38:07.284Z", "datePublished": "2025-12-03T13:52:44.692Z", "dateUpdated": "2026-04-08T16:59:48.496Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:59:48.496Z"}, "affected": [{"vendor": "optimizingmatters", "product": "Autoptimize", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.1.13", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the \"create_img_preload_tag\" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed5bdb3-c4cd-4982-bc47-feeff527e284?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3401333/autoptimize"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-11-10T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-11-19T18:29:52.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-03T00:32:37.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-03T14:47:52.328274Z", "id": "CVE-2025-13401", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T14:47:57.880Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13401", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-03T14:47:52.328274Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-03T14:47:54.721Z"}}], "cna": {"title": "Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "optimizingmatters", "product": "Autoptimize", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "3.1.13"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T00:00:00.000+00:00", "value": "Discovered"}, {"lang": "en", "time": "2025-11-19T18:29:52.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-03T00:32:37.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed5bdb3-c4cd-4982-bc47-feeff527e284?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3401333/autoptimize"}], "descriptions": [{"lang": "en", "value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the \"create_img_preload_tag\" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-12-03T13:52:44.692Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13401", "state": "PUBLISHED", "dateUpdated": "2025-12-03T14:47:57.880Z", "dateReserved": "2025-11-19T10:38:07.284Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-03T13:52:44.692Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Autoptimize", "vendor": "optimizingmatters", "versions": [{"lessThanOrEqual": "3.1.13", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Autoptimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the LCP Image to preload metabox in all versions up to, and including, 3.1.13 due to insufficient input sanitization and output escaping on user-supplied image attributes in the \"create_img_preload_tag\" function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin Autoptimize para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del metabox \u201cLCP Image to preload\u201d en todas las versiones hasta la 3.1.13, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes en los atributos de imagen proporcionados por el usuario en la funci\u00f3n \u201ccreate_img_preload_tag\u201d. Esto hace posible que atacantes autenticados, con acceso de nivel de colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-13401", "lastModified": "2026-10-18T17:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13401", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-03T14:47:52.328274Z", "version": "2.0.3"}}]}, "published": "2025-12-03T14:15:48.477", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3401333/autoptimize"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/6ed5bdb3-c4cd-4982-bc47-feeff527e284?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:49:30.541294+00:00", "value": {"mitigation_remediation": ["Upgrade Autoptimize to the latest certified version (3.1.14 or later).", "Disable the LCP Image preload metabox in the plugin settings until the patch is applied.", "Restrict contributor and higher-level user roles to trusted individuals and audit account privileges to reduce the risk of unauthorized script injection."], "summary": {"action": "Patch Immediately", "impact": "Stored Cross\u2011Site Scripting for authenticated users"}, "threat_synthesis": {"affected_systems": "WordPress sites that use the Autoptimize plugin version 3.1.13 or earlier are impacted. The vulnerability applies to any WordPress installation that has the plugin installed and configured with the LCP Image preload feature enabled.", "description_and_impact": "The Autoptimize plugin for WordPress is vulnerable to stored cross\u2011site scripting through the LCP Image preload metabox. The flaw arises from insufficient sanitization and escaping of user\u2011supplied image attributes in the \"create_img_preload_tag\" function, allowing an attacker with contributor\u2011level or higher access to inject arbitrary JavaScript that will execute whenever a user views an affected page.", "risk_and_exploitability": "With a CVSS score of 6.4, this issue is considered medium severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation at this time, and it is not listed in the CISA KEV catalog. The attack requires authentication with at least contributor privileges and depends on the attacker being able to alter the image attributes for the preload metabox; once the script is stored, it will run in the context of any visitor to the injected page, potentially compromising user sessions or data."}}}}, "created": "2025-12-04T16:44:27.788784+00:00", "updated": "2026-04-21T18:00:11.708407+00:00", "vendors": ["optimizingmatters", "optimizingmatters$PRODUCT$autooptimize", "wordpress", "wordpress$PRODUCT$wordpress"]}