CVE-2026-120739
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The Optimole plugin for WordPress (up to 4.2.18) is vulnerable to stored cross-site scripting via the `missing_srcsets[*][*].s` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits an injected page. The HMAC signature required for REST endpoint authorization is published in plaintext inside the `optimoleDataOptimizer` JavaScript object on pages with an incomplete profile, effectively removing the authentication barrier.
Risk Assessment
Possible execution of malicious script in a user's browser, potentially leading to session or credential theft. The vulnerability is easily exploitable by an unauthenticated attacker.
Recommendation
Update the Optimole plugin to a version later than 4.2.18. Until then, consider disabling the plugin or restricting access to pages with incomplete profiles.
Other vulnerabilities in Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization
See all- CVE-2026-120677High
The Optimole plugin for WordPress (up to 4.2.18) is vulnerable to stored cross-site scripting via the `comment` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits an injected page. Exploitation requires the comment to be approved by an administrator and the affected post to contain at least one iframe or video element (e.g., a core Video block), which is sufficient under default plugin settings where video lazy loading is enabled.
- CVE-2026-11784Medium
The Optimole plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to 4.2.6. The issue arises from missing or incorrect nonce validation in the replace_file function, allowing unauthenticated attackers to overwrite existing media attachments.
Original NVD description (English source)
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's (missing_srcsets[*][*].s)' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The HMAC signature required to pass the REST endpoint's authorization check is published in plaintext to unauthenticated visitors inside the inline optimoleDataOptimizer JavaScript object on any page with an incomplete profile, making the effective authentication barrier nonexistent.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS