Is CVE-2026-119070 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119070 being exploited in the wild.

How severe is CVE-2026-119070?

High severity, with a CVSS score of 7.2, published 7 November 2026.

Which products and versions are affected?

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization up to and including 4.2.17.

Is there a fix for CVE-2026-119070?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-119070 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-119070?

Check whether you run Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119070: Optimole image optimization plugin stored XSS in comment parameter

CVE-2026-119070 · Severity: high · CVSS 7.2 · Published 2026-11-07

The Optimole WordPress plugin optimizes and delivers images via a CDN to improve website performance. A flaw in how it processes comments allows unauthenticated attackers to inject malicious scripts that execute when users view the infected page, potentially stealing credentials or redirecting visitors to malicious sites. The vulnerability requires the plugin's CDN features to be enabled, which is the default configuration after setup.

Vendors: Optimole.

Quick answers

Is CVE-2026-119070 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119070 being exploited in the wild.
How severe is CVE-2026-119070?: High severity, with a CVSS score of 7.2, published 7 November 2026.
Which products and versions are affected?: Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization up to and including 4.2.17.
Is there a fix for CVE-2026-119070?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119070 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-119070?: Check whether you run Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin is vulnerable to stored cross-site scripting (XSS) via the comment parameter in versions up to 4.2.17. The vulnerability exists because Optimole's custom decoder produces HTML metacharacters at render time from a payload that contains none at storage time, allowing the payload to bypass WordPress comment sanitization filters. An unauthenticated attacker can inject arbitrary web scripts that persist in the database and execute in the browsers of any user viewing the comment.

Affected products

Optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization up to and including 4.2.17

Timeline

2026-11-07: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.