Skip to content
Threat Feed
Subscribe

Product

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization (<= 4.2.18)

2 briefs RSS
high advisory

Optimole: Stored XSS via missing_srcsets parameter (CVE-2026-120739)

The Optimole WordPress plugin up to version 4.2.18 is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization, allowing unauthenticated attackers to exploit a leaked HMAC signature and inject malicious scripts.

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization wordpress xss web-application cms
2t 1c
high advisory

Optimole WordPress Plugin: Stored Cross-Site Scripting (CVE-2026-120677)

The Optimole WordPress plugin (versions up to and including 4.2.18) is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping.

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization wordpress xss web-application cve-2026-120677
1c