Description

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.17 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit requires the plugin to be in its normal connected state (cdn_key and cdn_secret configured) with the image replacer enabled, which is the default post-setup configuration; the stored payload bypasses all WordPress comment sanitization filters because it contains no HTML metacharacters at storage time — the characters are produced only by Optimole's own decoder at render time.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-07T03:17:00.717Z",
  "pubdate": "2026-11-07T03:17:00.717Z",
  "executiveSummary": "The Optimole plugin for WordPress, in versions up to and including 4.2.17, contains a critical Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability originates from improper input sanitization and output escaping within the image optimization and CDN replacement pipeline.\nThe vulnerability allows unauthenticated attackers to inject malicious JavaScript payloads into comment fields, which are subsequently executed in the context of a victim's browser session upon viewing the compromised page.\nThe impact includes potential account takeover, session hijacking, defacement, or the redirection of users to malicious third-party domains.\nExploitation is feasible for unauthenticated attackers provided the plugin is in its default configured state (cdn_key and cdn_secret present) and the image replacement functionality is enabled.\nThe vulnerability is particularly severe because the payload bypasses standard WordPress comment filters by remaining inert during initial storage, only to be transformed into executable code by the plugin’s internal decoder at render time.",
  "technicalDetails": "The vulnerability resides in how the Optimole plugin handles the 'comment' parameter during its image replacement and rendering process. While WordPress implements robust default sanitization and escaping for comments, Optimole's internal processing logic acts as a secondary, flawed layer that inadvertently reconstructs malicious code.\nThe root cause is an insecure decoder implemented by the plugin. When the plugin is configured with a valid cdn_key and cdn_secret, it scans content for image URLs to offload to its CDN. During this process, it parses specific parameters, including those within comments. The plugin decodes encoded characters that are otherwise harmless at the time of database insertion. Because these characters are not re-sanitized after the plugin's internal decoding phase, they become executable HTML metacharacters.\nThe attack flow proceeds as follows: An unauthenticated attacker submits a comment containing an obfuscated payload designed to bypass WordPress filters (e.g., using encoded characters that appear as plain text in the database). The WordPress database stores the content in a sanitized state. When a user requests the page, the Optimole plugin's rendering logic intercepts the content. The plugin's decoder processes the image/CDN logic, effectively decoding the attacker's payload into active HTML tags (e.g., <script>).\nBecause this rendering happens server-side before the final HTML is sent to the client, the browser interprets the injected tags as legitimate content. This leads to the execution of arbitrary JavaScript. The requirement for the plugin to be fully configured as a CDN replacer is critical, as this process is what triggers the vulnerable decoding routine. All versions up to 4.2.17 are susceptible to this flaw.\nThe post-exploitation impact is significant. Since the script executes within the victim's browser, an attacker can perform actions on behalf of the user, such as modifying site content, stealing administrative session cookies, or injecting further malicious content into the site's front end. This vulnerability is classified as stored XSS, meaning the payload persists in the database and triggers every time the affected page is loaded, ensuring broad impact across the site's visitor base regardless of their authentication status."
}