{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/optimole--optimize-images--convert-webp--avif--cdn--lazy-load--image-optimization--4.2.17/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:optimole:optimole:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-119070"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Optimole – Optimize Images | Convert WebP \u0026 AVIF | CDN \u0026 Lazy Load | Image Optimization (\u003c= 4.2.17)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["Optimole"],"content_html":"\u003cp\u003eThe Optimole - Optimize Images | Convert WebP \u0026amp; AVIF | CDN \u0026amp; Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'comment' parameter in all versions up to, and including, 4.2.17. The vulnerability exists because the plugin fails to sanitize input and improperly handles output escaping.\u003c/p\u003e\n\u003cp\u003eThe exploit bypasses standard WordPress comment filters by storing payloads that do not contain HTML metacharacters at the time of entry; the characters are instead generated by the plugin's own decoder during rendering. Successful exploitation requires the plugin to be configured with a valid CDN key/secret and the image replacer enabled, which is the default configuration post-setup.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute in the context of any user who accesses an injected page, potentially leading to session hijacking, unauthorized actions, or further compromise of the victim's session.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Optimole plugin to the latest version beyond 4.2.17 once a patch is available.\u003c/li\u003e\n\u003cli\u003eReview plugin configuration settings to ensure unnecessary features such as 'image replacer' are disabled if not required for site functionality.\u003c/li\u003e\n\u003cli\u003eImplement a Content Security Policy (CSP) to mitigate the impact of XSS vulnerabilities by restricting the execution of unauthorized scripts.\u003c/li\u003e\n\u003cli\u003eAudit WordPress comment sections for anomalous script content if the site is suspected of being targeted.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:58:59Z","date_published":"2026-11-07T05:58:59Z","id":"https://feed.craftedsignal.io/briefs/2026-11-optimole-xss/","summary":"The Optimole WordPress plugin is vulnerable to stored Cross-Site Scripting via the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts due to improper output encoding during rendering.","title":"Optimole WordPress plugin: Stored Cross-Site Scripting (CVE-2026-119070)","url":"https://feed.craftedsignal.io/briefs/2026-11-optimole-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Optimole – Optimize Images | Convert WebP \u0026 AVIF | CDN \u0026 Lazy Load | Image Optimization (\u003c= 4.2.17)","version":"https://jsonfeed.org/version/1.1"}