CVE-2023-2113: Autoptimize

Medium severity, CVSS 4.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export, allowing high privileged users (such as an administrator) to inject arbitrary javascript into the admin panel, even when the unfiltered_html capability is disabled, such as in a multisite setup.

Affected products

• Autoptimize Autoptimize: before 3.1.7 (fixed in 3.1.7)

Published 2023-05-30. Last modified 2026-06-17.