CVE-2025-13401: WordPress Autoptimize Plugin XSS Vulnerability

CVE-2025-13401 Overview

CVE-2025-13401 is a Stored Cross-Site Scripting (XSS) vulnerability in the Autoptimize plugin for WordPress. The flaw affects all versions up to and including 3.1.13. It exists in the create_img_preload_tag function, which processes user-supplied image attributes for the Largest Contentful Paint (LCP) Image to preload metabox. Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. Injected payloads execute in the browser of any user who views the affected page. The vulnerability is tracked under CWE-79: Improper Neutralization of Input During Web Page Generation.

Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and administrative action abuse.

Affected Products

Autoptimize plugin for WordPress, versions ≤ 3.1.13
WordPress sites permitting contributor-level or higher registrations
Any site rendering pages that use the LCP Image to preload metabox

Discovery Timeline

2025-12-03 - CVE-2025-13401 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13401

Vulnerability Analysis

The Autoptimize plugin optimizes WordPress front-end performance, including preloading the Largest Contentful Paint (LCP) image to improve Core Web Vitals. The plugin exposes a metabox that lets post authors specify the LCP image and associated HTML attributes. The create_img_preload_tag function assembles the <link rel="preload"> or related image markup using those attributes.

Because the function does not sanitize input on save and does not escape values on output, an authenticated user can store attribute values containing script payloads or event handlers such as onerror and onload. When any visitor loads the affected page, the browser parses the injected markup and executes the attacker-controlled script in the context of the site origin.

Root Cause

The root cause is missing input validation and output encoding on user-supplied image attributes handled by create_img_preload_tag. WordPress provides esc_attr(), esc_url(), and wp_kses() helpers for exactly this purpose, but the vulnerable code path emits attribute values without applying them. This maps to CWE-79 — Improper Neutralization of Input During Web Page Generation.

Attack Vector

Exploitation requires an authenticated account with contributor privileges or higher. The attacker edits a post, opens the LCP Image preload metabox, and submits crafted attribute values that break out of the intended attribute context or introduce a scripting event handler. Once the post is published or previewed, every visitor — including logged-in administrators — executes the payload. See the Wordfence Vulnerability Report for additional context.

No verified public proof-of-concept code is available. The vulnerability mechanism is documented in the WordPress Autoptimize Changeset.

Detection Methods for CVE-2025-13401

Indicators of Compromise

Unexpected <script> tags, onerror, or onload attributes stored in wp_postmeta rows associated with Autoptimize LCP preload keys
Outbound requests from visitor browsers to unfamiliar domains sourced from post pages
New or modified administrator accounts created shortly after a contributor edited a post
Session cookies or nonces observed in web server access logs as query parameters to external hosts

Detection Strategies

Query the WordPress database for Autoptimize LCP metadata containing angle brackets, javascript:, or on*= attribute patterns
Review post revisions authored by contributor-role accounts for suspicious HTML in image attributes
Inspect rendered page source for <link rel="preload"> or <img> tags with attributes that decode to executable script
Correlate contributor edit events with subsequent administrator session activity in audit logs

Monitoring Recommendations

Enable WordPress audit logging to record post edits, role changes, and plugin configuration updates
Deploy a web application firewall (WAF) ruleset that inspects POST bodies to post.php and admin-ajax.php for XSS payloads
Monitor Content Security Policy (CSP) violation reports for inline script executions on public pages
Alert on new contributor or author account registrations followed by rapid post publication

How to Mitigate CVE-2025-13401

Immediate Actions Required

Update the Autoptimize plugin to a version later than 3.1.13 that includes the fix from changeset 3401333
Audit all existing posts for injected scripts in Autoptimize LCP image metadata and remove malicious values
Restrict contributor and author registrations, and review recently created low-privilege accounts
Rotate administrator passwords and invalidate active sessions if injected payloads were rendered

Patch Information

The fix is committed in WordPress plugin changeset 3401333, which adds sanitization and escaping to the create_img_preload_tag function. Site operators should upgrade Autoptimize to the first released version containing this changeset. Refer to the Wordfence Vulnerability Report for the fixed version number and additional advisory guidance.

Workarounds

Temporarily disable the Autoptimize LCP Image preload feature until the plugin is patched
Remove contributor and author role assignments from untrusted users and require editor review before publication
Deploy a strict Content Security Policy that blocks inline scripts and unapproved third-party domains
Place a WAF in front of /wp-admin/ to filter attribute payloads containing on*=, javascript:, or <script> tokens

bash

# Configuration example: update Autoptimize via WP-CLI
wp plugin update autoptimize --version=<patched-version>
wp plugin list --name=autoptimize --fields=name,status,version