Description

The AAA Autoload Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'option_page' parameter in all versions up to, and including, 1.7.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the plugin's Option Tracking setting to be configured to 'Legacy' mode, and succeeds despite WordPress ultimately returning HTTP 403 to the low-privileged caller because the vulnerable 'all' filter fires before the capability check in wp-admin/options.php.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-11-06T12:17:19.450Z",
  "pubdate": "2026-11-06T12:17:19.450Z",
  "executiveSummary": "The AAA Autoload Optimizer plugin for WordPress, in versions up to and including 1.7.0, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability via the 'option_page' parameter.\nThis vulnerability stems from inadequate input sanitization and output escaping within the plugin's data handling routines.\nAn authenticated attacker with subscriber-level privileges or higher can inject malicious JavaScript payloads into the WordPress environment.\nExploitation is contingent upon the plugin being configured in 'Legacy' mode for the 'Option Tracking' setting.\nAlthough the WordPress framework eventually issues an HTTP 403 Forbidden response to the low-privileged requester, the malicious payload is successfully processed and stored because the vulnerable 'all' filter executes prior to the standard capability checks within wp-admin/options.php.\nSuccessful exploitation allows for the execution of arbitrary scripts in the browsers of users accessing the affected administrative pages, potentially leading to unauthorized actions, session hijacking, or administrative privilege escalation.",
  "technicalDetails": "The vulnerability resides in the way AAA Autoload Optimizer hooks into the WordPress options update process. Specifically, the plugin employs a global 'all' filter that triggers during the execution of wp-admin/options.php. The root cause is the failure to enforce strict input sanitization on the 'option_page' parameter and the subsequent failure to apply context-aware output escaping when rendering this data.\nThe attack flow begins when an authenticated user, such as a subscriber, submits a crafted HTTP POST request to the WordPress administrative interface targeting the option saving mechanism. Despite the lack of sufficient administrative privileges to modify plugin settings, the 'all' hook fires early in the execution lifecycle. Because this filter processes the 'option_page' input before the core WordPress capability checks (is_admin() or current_user_can()) are evaluated, the malicious payload is effectively saved to the database.\nFor the exploitation to succeed, the 'Option Tracking' configuration must be set to 'Legacy' mode, which directs the plugin's internal logic to process input through the vulnerable code path. The attacker injects a script tag (e.g., <script>alert(document.cookie)</script>) into the 'option_page' parameter. The server-side code accepts this input and persists it. When an administrator or another user subsequently navigates to the affected page, the stored script is retrieved from the database and rendered directly into the HTML document without prior sanitization or escaping.\nThe execution occurs within the context of the victim's session, enabling the injected script to access sensitive cookies, perform actions on behalf of the user, or exfiltrate administrative session tokens. The HTTP 403 status code returned to the initial attacker is a post-processing artifact of the WordPress core security model, which occurs after the malicious data has already been stored by the vulnerable filter, rendering the 403 response ineffective at preventing the initial injection.\nThis vulnerability highlights a critical bypass of standard authorization workflows caused by the improper use of the 'all' filter, allowing low-privileged users to manipulate plugin state and persist malicious payloads in the application environment."
}