Optimole WordPress plugin stored cross-site scripting flaw
A WordPress image plugin can have malicious code planted that hurts visitors.
Summary
A input handling flaw in the Optimole image optimization plugin for WordPress lets unauthenticated attackers inject malicious scripts into pages. The scripts run for any user who opens an injected page. All versions up to and including 4.2.17 are affected.
Affected when
- Optimole service connected (cdn_key and cdn_secret configured)
- Image replacer enabled
What to do
Check that the plugin runs a version newer than 4.2.17 and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Times
First published
First seen