plugin
5 known security issues reported for the Lws Optimize WordPress plugin. Most recent disclosed Aug 4, 2026.
Running Lws Optimize on your site? Check whether your installed version is affected.
Scan your site freeThe LWS Optimize plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 4.1.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses...
The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to 3.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.
The LWS Optimize – All-in-One Speed Booster & Cache Tools plugin for WordPress is vulnerable to Arbitrary File Read in versions up to, and including, 3.3.19. This is due to the combine_current_css() function trusting <link rel="stylesheet" href="..."> values harvested from page HTML and converting same-site URLs to ab...
The LWS Optimize plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.9.1. This is due to missing or incorrect nonce validation on the several functions. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they...
Several LWS Plugins for WordPress are vulnerable to authorization bypass due to making admin settings pages available to users with read access (LWS Affiliation in versions up to, and including, 2.1; LWS Optimize in versions up to, and including, 1.5; LWS Tools in versions up to, and including, 2.1; LWS Cleaner in vers...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free