# CVE-2026-96531: Optimole WordPress plugin stored XSS in video-player block

Source: https://junglewise.ai/threats/cve-2026-96531-the-optimole-wordpress-plugin-before-4-2-13-does-not-escape  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-26. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-96531 · Severity: info · Published 2026-09-26

Optimole is a WordPress plugin that optimizes images and media for websites. The plugin before version 4.2.13 fails to properly escape custom attributes in its video player block, allowing authors and higher-privileged users to inject malicious scripts. When an administrator or other user views a post containing this malicious code, the script executes in their browser, potentially leading to account compromise or unauthorized actions.

Vendors: [Optimole](https://junglewise.ai/threats/vendors/optimole).

## Quick answers

**Is CVE-2026-96531 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96531 being exploited in the wild.

**How severe is CVE-2026-96531?** Informational severity, published 26 September 2026.

**Which products and versions are affected?** Optimole-Wp 4.0.0–4.2.12.

**Is there a fix for CVE-2026-96531?** A patch was published on 2026-09-26: version 4.2.13 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96531 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-96531?** Check whether you run Optimole-Wp at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the video-player block's attribute handling. Unrecognized attributes are rendered directly into the wrapper element without proper escaping, allowing Authors and above to inject event-handler attributes. Exploitation requires Author role or higher and does not require user interaction beyond normal post viewing by administrators or other users who see the infected content.

## Affected products

- Optimole optimole-wp 4.0.0–4.2.12

## Timeline

- 2026-09-24: disclosed
- 2026-09-26: patched: version 4.2.13

## References

- [https://wpscan.com/vulnerability/15ad5748-8c2b-4c60-9818-57790f7033c7/](https://wpscan.com/vulnerability/15ad5748-8c2b-4c60-9818-57790f7033c7/)

## Related threats

- [Optimole WordPress plugin sensitive data disclosure in dashboard widget](https://junglewise.ai/threats/cve-2026-96530-the-optimole-wordpress-plugin-before-4-2-15-does-not-perform-a)