Executive brief
Optimole is a popular WordPress plugin used for image optimization and content delivery. A security flaw in versions 4.2.7 and earlier allows an unauthenticated attacker to inject malicious scripts into the website. If a site administrator or visitor interacts with a specially crafted link, the attacker could potentially hijack sessions, redirect users to malicious sites, or deface the website.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Optimole plugin for WordPress (versions <= 4.2.7) due to improper neutralization of user-supplied input during web page generation (CWE-79). The vulnerability is unauthenticated, meaning an attacker does not need a login to initiate the attack, though it requires user interaction (typically a privileged user clicking a malicious link). Successful exploitation allows the execution of arbitrary JavaScript in the victim's browser, which can lead to session hijacking or unauthorized actions performed on behalf of the user. The issue is resolved in version 4.2.8.
Affected products
- Optimole Optimole <= 4.2.7
Timeline
- 2026-06-21: disclosed: Reported by daroo
- 2026-06-30: advisory: Patchstack published advisory
- 2026-07-02: advisory: NVD published CVE-2026-57673
- 2026-06-30: patched: Version 4.2.8 released