CVE-2025-13401

The Autoptimize plugin for WordPress has a security flaw affecting all versions up to 3.1.13, which allows malicious users with contributor-level access or higher to insert malicious code into webpage attributes. This vulnerability arises from inadequate protection against harmful input in the "create_img_preload_tag" function, enabling attackers to inject arbitrary scripts that will run when an affected page is accessed by another user.

Based on public CVE data (MITRE/NVD).