Description

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-28T05:16:46.223Z",
  "pubdate": "2026-08-28T05:16:46.223Z",
  "executiveSummary": "A critical vulnerability has been identified in the 'Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization' plugin for WordPress, affecting all versions up to and including 4.2.10. The security flaw is classified as Stored Cross-Site Scripting (XSS), which arises due to a lack of sufficient input sanitization and output escaping on the 'a' (above_fold_images) parameter.\nAn unauthenticated remote attacker can exploit this vulnerability by injecting arbitrary web scripts or malicious HTML into the vulnerable parameter. Because the input is persistently stored within the application's database, the injected scripts will execute automatically in the security context of any user's browser session upon accessing the affected page. This poses severe risks, including session hijacking, unauthorized administrative actions, and site defacement.",
  "technicalDetails": "The root cause of this vulnerability resides in the processing of the 'a' (above_fold_images) parameter within the Optimole plugin's configuration handling. In affected versions up to 4.2.10, the application accepts user-supplied input via this parameter and stores it in the database without passing it through rigorous sanitization filters, such as sanitize_text_field() or strict type validation.\nFurthermore, during the rendering phase of the affected web pages, the application retrieves the stored value of the 'a' parameter and outputs it directly into the HTML document object model (DOM) without applying context-aware escaping functions such as esc_attr() or esc_html(). This omission allows raw HTML tags and JavaScript event handlers or script blocks to be interpreted by the browser.\nThe attack flow proceeds as follows: 1. An unauthenticated attacker sends a crafted HTTP request to the WordPress site, targeting the endpoint that handles the 'above_fold_images' configuration and passing a malicious payload within the 'a' parameter. 2. The application processes the request and writes the unvalidated payload directly into the database. 3. A legitimate user or administrator visits a page that loads the 'above_fold_images' configuration. 4. The server retrieves the malicious payload from the database and embeds it into the HTML response. 5. The victim's browser renders the page, parsing the injected script as executable code, which then executes under the victim's session privileges."
}