CVE-2026-11784-Optimole-CSRF

CVE-2026-11784: CSRF a Sobrescritura Arbitraria de Archivos en el Plugin Optimole de WordPress Resumen Una vulnerabilidad de Cross-Site Request Forgery CSRF en el plugin Optimole para WordPress versiones = 4.2.5 permite a atacantes no autenticados sobrescribir silenciosamente activos existentes d...

CVE-2026-102375

Subscriber Broken Access Control in Optimole = 4.2.14 versions...

CVE-2026-102375

The Optimole plugin for WordPress (versions

CVE-2026-102375 WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability

Subscriber Broken Access Control in Optimole = 4.2.14 versions...

EUVD-2026-90221

Subscriber Broken Access Control in Optimole = 4.2.14 versions...

CVE-2026-102375 WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability

Subscriber Broken Access Control in Optimole = 4.2.14 versions...

WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Dthangws in WordPress Plugin Optimole versions = 4.2.14...

CVE-2026-102375: Missing Authorization

Subscriber Broken Access Control in Optimole = 4.2.14 versions...

CVE-2026-96531

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

CVE-2026-96531 Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

CVE-2026-96531

The Optimole WordPress plugin (versions 4.0.0 - 4.2.12 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is the failure to escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element. This allows users with the Author r...

WordPress Optimole plugin 4.0.0-4.2.12 - Author+ Stored XSS vulnerability

Author+ Stored XSS vulnerability discovered by Dmitrii Ignatyev in WordPress Plugin Optimole versions 4.0.0-4.2.12...

CVE-2026-96531 Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

EUVD-2026-87539

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

CVE-2026-96531: Improper Neutralization of Input During Web Page Generation

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user,...

WordPress Optimole plugin 4.2.3-4.2.11 - Unauthenticated Stored XSS vulnerability

Unauthenticated Stored XSS vulnerability discovered by Jakub Herman in WordPress Plugin Optimole versions 4.2.3-4.2.11...

CVE-2026-84829

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-84829 Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...

CVE-2026-84829

The Optimole WordPress plugin (versions 4.2.3-4.2.11 ) is vulnerable to Stored Cross-Site Scripting (XSS) because it fails to properly escape user-supplied values when building an image tag attribute. Specifically, the flaw involves the srcset descriptor parameter , which allows unauthenticated u...

EUVD-2026-80191

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting...