CVE-2026-57673

9th percentile — higher than 9% of all known CVEs

The Optimole plugin version 4.2.7 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. It allows a remote attacker to inject malicious script without requiring authentication.

An attacker can exploit this vulnerability to steal user sessions, redirect to malicious sites, or exfiltrate sensitive data from the WordPress admin panel.

Immediately update the Optimole plugin to the latest available version that fixes this vulnerability. Additionally, implement input filtering and output encoding mechanisms in the application.