Junglewise Threat Intelligence

CVE-2026-96531: Optimole WordPress plugin stored XSS in video-player block

CVE-2026-96531 · Severity: info · Published 2026-09-26

Vendors: Optimole.

Executive brief

Optimole is a WordPress plugin that optimizes images and media for websites. The plugin before version 4.2.13 fails to properly escape custom attributes in its video player block, allowing authors and higher-privileged users to inject malicious scripts. When an administrator or other user views a post containing this malicious code, the script executes in their browser, potentially leading to account compromise or unauthorized actions.

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the video-player block's attribute handling. Unrecognized attributes are rendered directly into the wrapper element without proper escaping, allowing Authors and above to inject event-handler attributes. Exploitation requires Author role or higher and does not require user interaction beyond normal post viewing by administrators or other users who see the infected content.

Affected products

  • Optimole optimole-wp 4.0.0–4.2.12

Timeline

  • 2026-09-24: disclosed
  • 2026-09-26: patched: version 4.2.13

References