Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization vulnerabilities

The Optimole plugin for WordPress (up to 4.2.18) is vulnerable to stored cross-site scripting via the `missing_srcsets[*][*].s` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits an injected page. The HMAC signature required for REST endpoint authorization is published in plaintext inside the `optimoleDataOptimizer` JavaScript object on pages with an incomplete profile, effectively removing the authentication barrier.

The Optimole plugin for WordPress (up to 4.2.18) is vulnerable to stored cross-site scripting via the `comment` parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user visits an injected page. Exploitation requires the comment to be approved by an administrator and the affected post to contain at least one iframe or video element (e.g., a core Video block), which is sufficient under default plugin settings where video lazy loading is enabled.

The Optimole plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to 4.2.6. The issue arises from missing or incorrect nonce validation in the replace_file function, allowing unauthenticated attackers to overwrite existing media attachments.