CVE-2026-96531 Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

EUVD-2026-87539

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

PT-2026-99251

Name of the Vulnerable Software and Affected Versions Optimole WordPress plugin versions prior to 4.2.13 Description The plugin fails to escape unrecognized attributes within its video-player block before rendering them onto the block's wrapper element. This allows users with the Author role or...

CVE-2026-96531: Improper Neutralization of Input During Web Page Generation

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

WordPress Optimole plugin 4.2.3-4.2.11 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Optimole versions 4.2.3-4.2.11...

CVE-2026-84829

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-84829 Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-84829 Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

EUVD-2026-80191

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-84829

The Optimole WordPress plugin (versions 4.2.3-4.2.11 ) is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to properly escape user-supplied values when building an image tag attribute. Specifically, the flaw involves the srcset descriptor parameter , which allows unauthenticated u...

PT-2026-93292

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-84829: Improper Neutralization of Input During Web Page Generation

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

WordPress Optimole plugin <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter vulnerability

Unauthenticated Stored Cross-Site Scripting via 'a' abovefoldimages Parameter vulnerability discovered by Osvaldo Noe Gonzalez Del Rio Os - krei.dev | ogbuilders.io in WordPress Plugin Optimole versions = 4.2.10...

CVE-2026-77365

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' abovefoldimages parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...

EUVD-2026-67398

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' abovefoldimages parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...

CVE-2026-77365 Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' abovefoldimages parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...

CVE-2026-77365

The Optimole image optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'a' (above_fold_images ) parameter in all versions up to and including 4.2.10 . The root cause is insufficient input sanitization and output escaping , allowing unauthenticated attacker...

CVE-2026-77365 Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' abovefoldimages parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...

PT-2026-82866

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' above fold images parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...

CVE-2026-77365: Improper Neutralization of Input During Web Page Generation

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' abovefoldimages parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output...