# Optimole <= 4.2.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Tag Attributes

- **ID:** WPSEC-2026-1330
- **Plugin:** Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization (`optimole-wp`), https://wordpress.org/plugins/optimole-wp/
- **Affected versions:** from 4.1.0 before 4.2.17
- **Fixed in:** 4.2.17 (Update to 4.2.17 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-21)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/optimole-wp
- **Fix released:** 2026-10-19
- **Published:** 2026-10-21
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1330/

## Description

The Optimole plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image tag attributes in versions 4.1.0 up to, and including, 4.2.16. This is due to the responsive srcset and sizes rewriting, which located the src, srcset and sizes attributes with string searches and regular expressions on the raw <img> markup: it matched that text inside the value of another attribute, such as alt or title, and accepted a value opened with one quote character and closed with the other, so the attribute it inserted or rewrote moved the point where the image's other attribute values end. This makes it possible for authenticated attackers, with contributor-level access and above, to turn text inside an image attribute value into new attributes, such as event handlers, and inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The rewrite applies to images for which the page profiler, enabled by default, has recorded size data.

## References

- https://wpsec.com/vuln/WPSEC-2026-1330/
- https://plugins.svn.wordpress.org/optimole-wp/tags/4.2.17/
- https://wordpress.org/plugins/optimole-wp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1330/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.