Junglewise Threat Intelligence

CVE-2026-5217: Optimole WordPress plugin stored XSS in REST endpoint

CVE-2026-5217 · Severity: high · CVSS 7.2 · Published 2026-04-11

Vendors: Optimole.

Executive brief

Optimole is a WordPress plugin used to optimize website images and improve loading speeds. A security flaw allows unauthenticated attackers to inject malicious scripts into website pages. This could lead to unauthorized actions being performed in a visitor's browser, potentially compromising user sessions or redirecting traffic to malicious sites.

Technical details

The Optimole plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to 4.2.2. The vulnerability exists in the unauthenticated /wp-json/optimole/v1/optimizations REST endpoint due to insufficient sanitization of the 's' (srcset descriptor) parameter. While the endpoint uses sanitize_text_field(), it fails to escape double quotes. Attackers can bypass HMAC validation because the required signature and timestamp are exposed in the frontend HTML. The malicious payload is stored in WordPress transients and later rendered without proper escaping in tag_replacer.php, enabling arbitrary script execution in the context of a user's browser.

Affected products

  • Optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization Up to and including 4.2.2

Timeline

  • 2026-04-11: advisory: NVD published the vulnerability details.

References