Skip to content
Threat Feed
Subscribe

CPE

Cpe:2.3:a:optimole:optimole_-_Optimize_images_|_convert_webp_&_avif_|_cdn_&_lazy_load_|_image_optimization:*:*:*:*:*:wordpress:*:*

1 brief RSS
high advisory

Optimole: Stored XSS via missing_srcsets parameter (CVE-2026-120739)

The Optimole WordPress plugin up to version 4.2.18 is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization, allowing unauthenticated attackers to exploit a leaked HMAC signature and inject malicious scripts.

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization wordpress xss web-application cms
2t 1c