CVE-2026-78471

Executive Summary

CVE-2026-78471 is a stored cross-site scripting (XSS) vulnerability in the Autoptimize WordPress plugin affecting all versions up to and including 3.1.15.1. It arises from insufficient input sanitization and output escaping of the Comment Author Name field, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim views an injected page. Successful exploitation—strictly conditional on several environmental prerequisites and moderator approval of the malicious comment—yields low-confidentiality and low-integrity impact with a scope change (CVSS 5.4). No public PoC or Nuclei template exists, and exploitation is not observed in the wild.

Technical Analysis

Autoptimize is a popular WordPress optimization plugin that aggregates, minifies, and defers CSS/JavaScript and handles image lazy-loading. CVE-2026-78471 is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Stored XSS). The vulnerable sink is the WordPress comment author name, which the plugin fails to sanitize on input and escape on output. When a comment is rendered within a page that Autoptimize post-processes, attacker-controlled author-name markup is emitted into the HTML without neutralization, allowing script execution in victim browsers.

The vulnerability class has a well-understood root cause: the plugin's HTML post-processing path does not apply context-aware output encoding to the comment author name before it is written into the optimized output. Because the flaw is stored, the payload persists until the comment is removed. Any unauthenticated visitor can supply the comment author name via the standard WordPress comment form; however, as the NVD description notes, the malicious comment must be approved by a moderator before the payload renders, which is why the access vector is network but attack complexity is characterized as high (AC:H) and no privileges are required (PR:N).

Critically, the NVD description identifies four environmental preconditions that must all be satisfied for the payload to execute:

1. An administrator must have enabled Autoptimize's "Lazy-load images?" option. This constrains the vulnerable code path to sites where that specific optimization setting is active.
2. The file w3-total-cache/w3-total-cache.php must be present on disk with the W3 Total Cache plugin disabled (installed but inactive).
3. A class named Minify_HTML must be loaded into scope by another plugin. This indicates a cross-plugin collision: the vulnerable Autoptimize path depends on a class that derives from a different codebase being resident in the runtime, rather than being a self-contained defect.
4. The malicious comment must be approved by a moderator before rendering.

The second and third conditions are the most restrictive and explain why the CVSS base is only 5.4 despite network reachability and unauthenticated input. The scope-change metric (S:C) reflects that the XSS executes in the context of the affected WordPress site and can act beyond the plugin's own trust boundary. Sub-scores: confidentiality Low (C:L) and integrity Low (I:L) because typical stored XSS impact in WordPress is session/cookie theft or limited page-content manipulation rather than direct server compromise; availability None (A:N).

The NVD description does not disclose the specific function, hook, or file within Autoptimize that processes the author name, nor the exact injection context (attribute, element text, or script). Those implementation details are not available and should not be assumed. What can be stated precisely is that the defect is an output-escaping failure within Autoptimize's optimization/render pipeline, gated by an uncommon plugin-state combination.

Exploitation Scenarios

No public PoC, Nuclei template, or exploit code is available. The attack chain below is inferred strictly from the NVD description and the stored-XSS vulnerability class; it does not rely on any undisclosed implementation specifics.

1. Reconnaissance and target identification. An attacker identifies WordPress sites running Autoptimize at a version ≤ 3.1.15.1. Public fingerprinting is possible through page source references to the plugin directory and through the presence of optimization artifacts in generated HTML. The attacker additionally needs to confirm the environmental prerequisites: that the "Lazy-load images?" option is enabled, that the w3-total-cache/w3-total-cache.php file is present on disk while the W3 Total Cache plugin is disabled, and that another plugin has loaded a class named Minify_HTML into scope. Because these conditions are largely invisible to an external observer, this vulnerability is not trivially targetable at scale; exploitation is most plausible in scenarios where the attacker has prior knowledge of the target's plugin inventory (for example, a known deployment or an insider-adjacent context).

2. Triggering the flaw class. The attacker submits a comment to the target site and places a script payload in the Comment Author Name field. This is an unauthenticated action reachable through the normal public comment interface. No account or authentication is required (PR:N). The payload is stored by WordPress; the injection survives until the comment is moderated or deleted.

3. Payload capture and render. The comment must be approved by a moderator. On approval, the author name is emitted into pages rendered through Autoptimize's affected path. Because output escaping is insufficient, the browser interprets the injected markup as script rather than text, and the script executes in the origin of the affected site whenever any user accesses the injected page (UI:N — no user interaction beyond viewing the page).

4. Post-exploitation impact. Executing script in the site's origin enables classic stored-XSS objectives: theft of non-HttpOnly cookies or session identifiers, unauthorized actions performed as the viewing user (including administrative actions if an administrator views the page), redirection to attacker-controlled infrastructure, and modification of page content. Impact is bounded by CVSS to Low confidentiality and Low integrity with a scope change. The NVD entry does not describe any server-side code execution or database compromise.

Because approval by a moderator and the plugin-state preconditions are mandatory, weaponization requires either a target with a permissive or automated comment-approval process or a multi-stage campaign in which an attacker first induces approval. The absence of public tooling and the high attack complexity account for the currently low likelihood of widespread exploitation.

Impact Assessment

Affected systems are WordPress installations running Autoptimize version 3.1.15.1 or earlier that simultaneously satisfy the four preconditions in the NVD description. The realistic blast radius is therefore a subset of all Autoptimize installs, not the entire installed base.

Business impact stems from stored XSS in a trusted web origin. High-value targets include sites where administrators or privileged users browse comment-bearing pages while authenticated; successful script execution in that context can enable session hijacking and unauthorized administrative actions. Defacement via injected content and reputational damage are secondary concerns. CVSS 5.4 (Medium) with AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N reflects a remotely reachable, unauthenticated injection whose practical severity is significantly mitigated by the high attack complexity imposed by the environmental prerequisites. The scope-change metric indicates that the vulnerability's effect extends beyond the Autoptimize component itself into the broader WordPress application context. Availability is unaffected (A:N), and there is no indication of direct server compromise. EPSS is not yet scored by FIRST.org, so no exploitation-probability estimate is available; CISA KEV does not list this CVE, and there is no evidence of active exploitation in the wild.

Detection Guidance

Sigma Rule

title: Stored XSS via WordPress Comment Author Name (Autoptimize CVE-2026-78471)
id: 4a2c9e10-7b6d-4f3a-9c21-8e5d1f2b6a30
status: experimental
description: Detects submission of comments containing script-like markup in the WordPress comment author name field, consistent with CVE-2026-78471.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-78471
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection_method:
    cs-method: 'POST'
  selection_path:
    cs-uri-query|contains: 'wp-comments-post.php'
  selection_author:
    cs-uri-query|contains:
      - 'author=%3Cscript'
      - 'author=<script'
      - 'author=%3Cimg'
      - 'author=<img'
      - 'author=%22%3E%3Cscript'
      - 'author="><script'
      - 'author=javascript%3A'
  filter_benign:
    cs-uri-query|contains: 'author=%3Cscript%3Ealert%28%22test%22%29'
  condition: selection_method and selection_path and selection_author and not filter_benign
falsepositives:
  - Security scanners and penetration testing
  - Legitimate users with unusual display names
level: medium
tags:
  - attack.t1190
  - cve.2026.78471

YARA Rule

rule CVE_2026_78471_Autoptimize_Stored_XSS
{
    meta:
        author = "valtersit.com"
        description = "Detects stored XSS payloads targeting the Autoptimize comment author name vulnerability (CVE-2026-78471)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-78471"
        date = "2026-01-01"
        cve = "CVE-2026-78471"

    strings:
        $comment_form = "wp-comments-post.php"
        $author = "author="
        $autoptimize = "autoptimize"

        $s1 = "<script" nocase
        $s2 = "javascript:" nocase
        $s3 = "onerror=" nocase
        $s4 = "onload=" nocase
        $s5 = "><svg" nocase
        $s6 = "document.cookie" nocase

    condition:
        (uint16(0) == 0x3C25) and
        $comment_form and $author and
        (
            any of ($s1, $s2, $s3, $s4, $s5, $s6)
        )
        or
        (
            $autoptimize and $comment_form and any of ($s1, $s2, $s3)
        )
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78471 Autoptimize Stored XSS via Comment Author Name"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"wp-comments-post.php"; nocase; http.request_body; content:"author="; nocase; fast_pattern; http.request_body; pcre:"/author=(%3C|<)(script|img|svg|iframe)/iU"; reference:cve,2026-78471; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78471; classtype:web-application-attack; sid:202678471; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where http.request.method == "POST" and
     network.protocol == "http" and
     url.path like "*wp-comments-post.php"]
  [network where http.request.method == "POST" and
     http.request.body.content regex
       "author=(%3C|<)(script|img|svg|iframe|body)"
     and url.path like "*wp-comments-post.php"]

Splunk SPL Query

index=web sourcetype=access_combined
| search method=POST uri_path="*wp-comments-post.php*"
| rex field=form_data "(?i)author=(?<author_field>[^&]+)"
| where match(author_field, "(?i)(%3C|<)\s*(script|img|svg|iframe|body)|javascript:|onerror=|onload=")
| stats count min(_time) as first_seen max(_time) as last_seen values(src_ip) as sources by host, uri_path, author_field
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="web,wordpress,autoptimize,">
  <rule id="202678471" level="10">
    <if_sid>31103</if_sid>
    <decoded_as>web-accesslog</decoded_as>
    <id>^202678471$</id>
    <description>CVE-2026-78471: Possible Autoptimize stored XSS - malicious payload in WordPress comment author name</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_78471,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed). NVD lists no vendor fix and no affected-version data, so the patch status should be treated as unverified. Security teams should confirm directly with the Autoptimize project and WordPress.org before assuming any specific version is fixed.

Immediate mitigations:

1. Disable comment functionality on affected sites, or require strict manual moderation of all comments with administrative review of comment author names before approval. Because exploitation depends on moderator approval, controlling approval workflow directly blocks the render stage.
2. Disable Autoptimize's "Lazy-load images?" option if the site can tolerate the performance impact. The NVD description explicitly ties exploitation to this setting being enabled, so turning it off removes the precondition.
3. Remove or properly manage the W3 Total Cache plugin state so that the file w3-total-cache/w3-total-cache.php is not present on disk while the plugin is disabled. Because exploitation requires the file to remain on disk with the plugin inactive, fully uninstalling unused optimization plugins reduces exposure.
4. Audit plugins to identify any that load a class named Minify_HTML into scope and assess whether that cross-plugin condition can be avoided.
5. Enforce a Content Security Policy that restricts inline script execution to blunt the practical impact of any stored XSS that reaches a rendered page.

Patch/upgrade steps:

1. Verify the current Autoptimize version. Treat all versions up to and including 3.1.15.1 as vulnerable per the CNA title.
2. Check the WordPress.org plugin repository and the Autoptimize project channels for an official advisory and fixed release; the single-source patch claim in NVD is not sufficient for production change control.
3. If a fixed version is confirmed, stage and test the upgrade in a non-production environment before rollout, and re-verify that the four preconditions no longer result in unescaped output.
4. If no fixed release exists, treat the mitigations above as the compensating control set and monitor vendor channels.

Long-term hardening:

1. Adopt vulnerability management practices that flag cross-plugin and configuration-dependent vulnerabilities, since this CVE requires a specific multi-plugin state rather than a standalone flaw.
2. Maintain an accurate plugin inventory and remove fully unused plugins, including their on-disk files, to eliminate dormant-code preconditions.
3. Apply least-privilege to comment moderation and session cookies (mark cookies HttpOnly and Secure) to reduce XSS impact.
4. Deploy the detection rules above to catch payloads in comment author fields at submission time.

References

• NVD — CVE-2026-78471: https://nvd.nist.gov/vuln/detail/CVE-2026-78471
• CWE-79 — Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html
• Autoptimize plugin (WordPress.org): https://wordpress.org/plugins/autoptimize/
• FIRST EPSS (score not yet available for this CVE): https://www.first.org/epss/
• CISA Known Exploited Vulnerabilities Catalog (CVE not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public proof-of-concept, Nuclei template, or exploit code is available for CVE-2026-78471. There is no evidence of active exploitation in the wild, no CISA KEV listing, and no reported threat-actor campaign associated with this vulnerability. The EPSS score has not yet been assigned by FIRST.org.