Executive brief
Optimole is a WordPress plugin that optimizes and delivers images efficiently. An unauthenticated attacker can inject malicious JavaScript code that persists in the website and executes in the browsers of all visitors, potentially compromising user accounts, stealing credentials, or defacing the website.
Technical details
The vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Optimole WordPress plugin affecting versions up to 4.2.10. The 'a' parameter (above_fold_images) in the REST API endpoint fails to properly sanitize and escape user input, allowing unauthenticated attackers to inject arbitrary JavaScript. The injected payload is stored in the database and executed in the browsers of all users who access affected pages. No authentication is required to exploit this vulnerability, and successful exploitation can lead to session hijacking, credential theft, or malware distribution to website visitors.
Affected products
- Optimole Optimole – Optimize Images up to and including 4.2.10
Timeline
- 2026-08-28: disclosed