CVE-2026-102375

The Optimole WordPress plugin before version 4.2.15 does not perform a capability check before exposing stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element. Users with the Author role and above can store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute. This allows unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Optimole plugin version 4.2.7 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. It allows a remote attacker to inject malicious script without requiring authentication.

The Optimole plugin for WordPress up to version 4.1.0 is vulnerable to Insecure Direct Object Reference (IDOR) in the /wp-json/optml/v1/move_image REST API endpoint due to missing validation on a user-controlled key. This allows authenticated attackers with Author-level access or above to offload media that doesn't belong to them.