Executive brief
Optimole is a WordPress plugin that optimizes images and media for websites. The plugin before version 4.2.13 fails to properly escape custom attributes in its video player block, allowing authors and higher-privileged users to inject malicious scripts. When an administrator or other user views a post containing this malicious code, the script executes in their browser, potentially leading to account compromise or unauthorized actions.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the video-player block's attribute handling. Unrecognized attributes are rendered directly into the wrapper element without proper escaping, allowing Authors and above to inject event-handler attributes. Exploitation requires Author role or higher and does not require user interaction beyond normal post viewing by administrators or other users who see the infected content.
Affected products
- Optimole optimole-wp 4.0.0–4.2.12
Timeline
- 2026-09-24: disclosed
- 2026-09-26: patched: version 4.2.13