Stored Cross-Site Scripting in Optimole WordPress Plugin

The Optimole - Optimize Images plugin for WordPress (all versions up to and including 4.2.10) contains a critical security flaw involving insufficient input sanitization and output escaping. Specifically, the 'a' (above_fold_images) parameter fails to properly sanitize user-supplied input. This flaw allows an unauthenticated attacker to inject malicious JavaScript payloads into affected WordPress pages. When a user, such as a site administrator or privileged user, accesses the compromised page, the injected script executes within the context of their session. This vulnerability poses a significant risk for session hijacking, unauthorized administrative actions, or the redirection of site visitors to malicious domains. Organizations utilizing this plugin should upgrade to a patched version immediately upon availability or implement web application firewall rules to block suspicious input in the specified parameter.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the browsers of users viewing the affected pages. This can lead to the theft of session cookies, account takeover of authenticated administrators, or the injection of malicious content into the site, damaging site integrity and potentially leading to further compromise of site visitors.

Recommendation

• Upgrade the Optimole plugin to the latest version, ensuring all security patches are applied.
• Monitor web server access logs for HTTP requests containing suspicious script tags or JavaScript event handlers within the 'a' query parameter or request body associated with the plugin.
• Deploy WAF rules to validate input for the 'a' parameter, ensuring it adheres to expected data types and blocking payloads containing characters typical of XSS (e.g., <script>, javascript:, onload=).