Description

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the comment to be approved by an administrator and for the affected post to contain at least one iframe or video element (e.g., a core Video block), which is sufficient under default plugin settings where video lazy loading is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-11-07T04:17:13.537Z",
  "pubdate": "2026-11-07T04:17:13.537Z",
  "executiveSummary": "The Optimole image optimization plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability affecting versions up to and including 4.2.18.\nThe vulnerability arises from improper sanitization of user-supplied input within the 'comment' parameter, allowing unauthenticated attackers to inject malicious JavaScript payloads.\nSuccessful exploitation requires the injection of a payload into a comment field, which must subsequently be approved by an administrator.\nThe attack vector is contingent upon the presence of an iframe or video element (such as a core WordPress Video block) on the page where the comment is displayed, which triggers the plugin's lazy loading functionality.\nIf executed, the injected script runs within the context of the victim's browser, potentially leading to unauthorized actions, session hijacking, or defacement.\nThis vulnerability poses a significant risk to site integrity and user security, as it allows arbitrary code execution in the context of the application's origin.",
  "technicalDetails": "The root cause of this vulnerability is the failure of the Optimole plugin to adequately sanitize user input provided via the 'comment' parameter before rendering it in the DOM.\nThe vulnerability is tied to the plugin's video/iframe lazy loading feature. When the plugin processes content containing video or iframe elements, it improperly handles metadata or context associated with comments, leading to an execution sink.\nThe attack flow begins when an unauthenticated attacker submits a crafted comment containing a malicious JavaScript payload. This payload remains in the database until an administrator approves the comment for public visibility.\nOnce the comment is approved, the malicious script is stored persistently. The payload remains latent until a user—which could include an administrator or a general site visitor—views the affected page. Because the plugin's lazy loading functionality processes content dynamically, it inadvertently triggers the execution of the injected script when it interacts with the iframe or video components on the page.\nThe technical requirement for an iframe or video element serves as the trigger mechanism. The plugin's logic for processing these elements effectively circumvents standard WordPress output escaping routines, allowing the malicious script to be injected directly into the HTML document stream.\nBecause the payload is stored in the WordPress database, this is classified as a Stored XSS vulnerability. The impact is elevated as the script executes every time an affected page is loaded, regardless of the target's authentication status, provided they have access to the page.\nAttackers can leverage this access to perform various malicious activities, such as capturing session cookies, performing unauthorized administrative actions via forged requests (CSRF), or redirecting users to malicious external domains. Given the nature of Stored XSS, it can be used for persistent monitoring or persistent disruption of the affected site's operations."
}