CVE-2026-96530
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
The Optimole WordPress plugin before version 4.2.15 does not perform a capability check before exposing stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
Risk Assessment
Exposure of third-party service credentials may allow unauthorized access to service accounts, potentially leading to data breaches or unauthorized operations.
Recommendation
Update the Optimole plugin to version 4.2.15 or later to ensure proper capability checks. Additionally, review access logs for unauthorized reads.
Other vulnerabilities in Optimole
See all- CVE-2026-102375Medium
The Optimole WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.2.14.
- CVE-2026-96531Medium
The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element. Users with the Author role and above can store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.
- CVE-2026-84829High
The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute. This allows unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.
- CVE-2026-77365High
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-57673High
The Optimole plugin version 4.2.7 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. It allows a remote attacker to inject malicious script without requiring authentication.
- CVE-2025-11519Medium
The Optimole plugin for WordPress up to version 4.1.0 is vulnerable to Insecure Direct Object Reference (IDOR) in the /wp-json/optml/v1/move_image REST API endpoint due to missing validation on a user-controlled key. This allows authenticated attackers with Author-level access or above to offload media that doesn't belong to them.
Original NVD description (English source)
The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS