{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/optimole--optimize-images--convert-webp--avif--cdn--lazy-load--image-optimization--4.2.18/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:optimole:optimole_-_optimize_images_|_convert_webp_\u0026_avif_|_cdn_\u0026_lazy_load_|_image_optimization:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-120739"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Optimole – Optimize Images | Convert WebP \u0026 AVIF | CDN \u0026 Lazy Load | Image Optimization (\u003c= 4.2.18)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","web-application","cms"],"_cs_type":"advisory","_cs_vendors":["Optimole"],"content_html":"\u003cp\u003eThe Optimole plugin for WordPress, specifically versions 4.2.18 and earlier, contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw stems from insufficient input sanitization and output escaping within the 'missing_srcsets' parameter. Furthermore, the plugin unintentionally exposes a required HMAC signature in plaintext via the 'optimoleDataOptimizer' JavaScript object to any unauthenticated visitor on pages with an incomplete profile, rendering the REST API authentication mechanism ineffective.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to inject arbitrary web scripts into pages. These scripts execute in the context of the user viewing the affected page, which could lead to unauthorized actions, session hijacking, or credential theft if an administrator views the injected content.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the Optimole plugin to a version beyond 4.2.18 immediately to remediate the input sanitization flaw.\u003c/li\u003e\n\u003cli\u003eImplement a Content Security Policy (CSP) to mitigate the impact of potential XSS attacks by restricting the execution of unauthorized inline scripts.\u003c/li\u003e\n\u003cli\u003eAudit logs for suspicious REST API requests targeting the Optimole plugin endpoints, particularly those originating from unauthorized or anonymous user agents.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:59:28Z","date_published":"2026-11-07T05:59:28Z","id":"https://feed.craftedsignal.io/briefs/2026-11-optimole-xss-432d9959/","summary":"The Optimole WordPress plugin up to version 4.2.18 is vulnerable to Stored Cross-Site Scripting (XSS) due to insufficient sanitization, allowing unauthenticated attackers to exploit a leaked HMAC signature and inject malicious scripts.","title":"Optimole: Stored XSS via missing_srcsets parameter (CVE-2026-120739)","url":"https://feed.craftedsignal.io/briefs/2026-11-optimole-xss-432d9959/"},{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:optimole:optimize_images_convert_webp_avif_cdn_lazy_load_image_optimization:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-120677"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Optimole – Optimize Images | Convert WebP \u0026 AVIF | CDN \u0026 Lazy Load | Image Optimization (\u003c= 4.2.18)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","web-application","cve-2026-120677"],"_cs_type":"advisory","_cs_vendors":["Optimole"],"content_html":"\u003cp\u003eThe Optimole - Optimize Images | Convert WebP \u0026amp; AVIF | CDN \u0026amp; Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'comment' parameter in all versions up to, and including, 4.2.18.\u003c/p\u003e\n\u003cp\u003eAn unauthenticated attacker can inject arbitrary web scripts into pages. Execution occurs when a user accesses an injected page, provided the comment has been approved by an administrator and the post contains an iframe or video element, which triggers the plugin's video lazy loading functionality.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary web scripts in the user's browser.\u003c/p\u003e\n\u003ch2 id=\"cve-details\"\u003eCVE Details\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eID: CVE-2026-120677\u003c/li\u003e\n\u003cli\u003eCVSS v3.1 Base Score: 7.2\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-07T05:59:20Z","date_published":"2026-11-07T05:59:20Z","id":"https://feed.craftedsignal.io/briefs/2026-11-optimole-xss-72402503/","summary":"The Optimole WordPress plugin (versions up to and including 4.2.18) is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter due to insufficient input sanitization and output escaping.","title":"Optimole WordPress Plugin: Stored Cross-Site Scripting (CVE-2026-120677)","url":"https://feed.craftedsignal.io/briefs/2026-11-optimole-xss-72402503/"}],"language":"en","title":"CraftedSignal Threat Feed - Optimole – Optimize Images | Convert WebP \u0026 AVIF | CDN \u0026 Lazy Load | Image Optimization (\u003c= 4.2.18)","version":"https://jsonfeed.org/version/1.1"}