Optimole <= 4.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes
- ID
- WPSEC-2026-1330
- Plugin
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization (optimole-wp)
- Affected
- from 4.1.0 before 4.2.17
- Remediation
- Update to 4.2.17 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-21
- Attack surface
- Optimole on WPSec AttackSurface
- Fix released
- Published
Description
The Optimole plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image tag attributes in versions 4.1.0 up to, and including, 4.2.16. This is due to the responsive srcset and sizes rewriting, which located the src, srcset and sizes attributes with string searches and regular expressions on the raw <img> markup: it matched that text inside the value of another attribute, such as alt or title, and accepted a value opened with one quote character and closed with the other, so the attribute it inserted or rewrote moved the point where the image's other attribute values end. This makes it possible for authenticated attackers, with contributor-level access and above, to turn text inside an image attribute value into new attributes, such as event handlers, and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The rewrite applies to images for which the page profiler, enabled by default, has recorded size data.
References
- https://wpsec.com/vuln/WPSEC-2026-1330/
- https://plugins.svn.wordpress.org/optimole-wp/tags/4.2.17/
- https://wordpress.org/plugins/optimole-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS