CVE-2026-16032
LWS Optimize < 4.1.2 - Unauthenticated Stored XSS via Real User Monitoring
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The LWS Optimize WordPress plugin before 4.1.2 does not properly escape a value submitted through an unauthenticated analytics endpoint before storing it and rendering it in an administrative dashboard, allowing unauthenticated attackers to inject arbitrary web scripts that execute when an administrator views the affected dashboard page.
| Vendor | unknown |
| Product | lws optimize |
| Published | Aug 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown lws optimize
Be the first to know when new unknown vulnerabilities affecting unknown lws optimize are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / LWS Optimize
0 < 4.1.2
References
Credits
Artus KG WPScan