Optimole WordPress Plugin: Stored Cross-Site Scripting (CVE-2026-120677)
The Optimole WordPress plugin (versions up to and including 4.2.18) is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping.
CVE search metadata
CVE search record: CVE-2026-120677. Severity: high. CVSS: 7.2. KEV: no. Product: Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization (<= 4.2.18). Brief: Optimole WordPress Plugin: Stored Cross-Site Scripting (CVE-2026-120677). Brief link: https://feed.craftedsignal.io/briefs/2026-11-optimole-xss-72402503/
Triage facts
Revision 1- Applicability
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization (<= 4.2.18)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 7, 05:59 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
The Optimole - Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'comment' parameter in all versions up to, and including, 4.2.18.
An unauthenticated attacker can inject arbitrary web scripts into pages. Execution occurs when a user accesses an injected page, provided the comment has been approved by an administrator and the post contains an iframe or video element, which triggers the plugin's video lazy loading functionality.
Impact
Successful exploitation allows for the execution of arbitrary web scripts in the user's browser.
CVE Details
- ID: CVE-2026-120677
- CVSS v3.1 Base Score: 7.2