Optimole: Stored XSS via missing_srcsets parameter (CVE-2026-120739)

The Optimole plugin for WordPress, specifically versions 4.2.18 and earlier, contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw stems from insufficient input sanitization and output escaping within the 'missing_srcsets' parameter. Furthermore, the plugin unintentionally exposes a required HMAC signature in plaintext via the 'optimoleDataOptimizer' JavaScript object to any unauthenticated visitor on pages with an incomplete profile, rendering the REST API authentication mechanism ineffective.

Impact

Successful exploitation allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute in the context of the user viewing the affected page, which could lead to unauthorized actions, session hijacking, or credential theft if an administrator views the injected content.

Recommendation

• Upgrade the Optimole plugin to a version beyond 4.2.18 immediately to remediate the input sanitization flaw.
• Implement a Content Security Policy (CSP) to mitigate the impact of potential XSS attacks by restricting the execution of unauthorized inline scripts.
• Audit logs for suspicious REST API requests targeting the Optimole plugin endpoints, particularly those originating from unauthorized or anonymous user agents.