Junglewise Threat Intelligence

CVE-2026-5226: Optimole WordPress Plugin reflected XSS via URL paths

CVE-2026-5226 · Severity: medium · CVSS 6.1 · Published 2026-04-11

Vendors: Optimole.

Executive brief

The Optimole plugin for WordPress, which is used to optimize and speed up image loading on websites, contains a security flaw that allows for reflected cross-site scripting. An attacker can trick a user into clicking a malicious link, allowing the attacker to run unauthorized scripts in the user's browser. This could lead to the theft of sensitive information or unauthorized actions being performed on behalf of the user.

Technical details

The Optimole plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) due to insufficient output escaping on user-supplied URL paths. Specifically, the 'get_current_url()' function retrieves the path, which is then inserted into JavaScript code via 'str_replace()' within the 'replace_content()' function without proper context-aware escaping. An unauthenticated remote attacker can exploit this by crafting a malicious URL and tricking a user into visiting it. Successful exploitation allows the execution of arbitrary JavaScript in the context of the victim's browser session. The issue is fixed in version 4.2.4.

Affected products

  • Optimole Optimole – Optimize Images in Real Time up to, and including, 4.2.3

Timeline

  • 2026-04-11: disclosed
  • 2026-04-11: advisory

References