CVE-2026-96531
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element. Users with the Author role and above can store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.
Risk Assessment
An attacker with Author role can inject malicious scripts that execute in the administrator's browser, potentially leading to admin account takeover or unauthorized actions.
Recommendation
Update the plugin to version 4.2.13 or later. Additionally, restrict user roles and implement Content Security Policy (CSP).
Other vulnerabilities in Optimole
See all- CVE-2026-96530Medium
The Optimole WordPress plugin before version 4.2.15 does not perform a capability check before exposing stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.
- CVE-2026-102375Medium
The Optimole WordPress plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. The issue affects versions up to and including 4.2.14.
- CVE-2026-84829High
The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute. This allows unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.
- CVE-2026-77365High
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- CVE-2026-57673High
The Optimole plugin version 4.2.7 and earlier contains an unauthenticated Cross Site Scripting (XSS) vulnerability. It allows a remote attacker to inject malicious script without requiring authentication.
- CVE-2025-11519Medium
The Optimole plugin for WordPress up to version 4.1.0 is vulnerable to Insecure Direct Object Reference (IDOR) in the /wp-json/optml/v1/move_image REST API endpoint due to missing validation on a user-controlled key. This allows authenticated attackers with Author-level access or above to offload media that doesn't belong to them.
Original NVD description (English source)
The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS