Optimole WordPress plugin comment script injection flaw
A WordPress image plugin's comments can plant malicious scripts on visitors' screens.
Summary
Weak input checks let an unauthenticated attacker plant malicious scripts on pages through comments. The script runs when a visitor opens the page, once an administrator approves the comment and the post has an iframe or video element. All versions up to and including 4.2.18 are affected.
Affected when
- An administrator approves the comment
- The post has an iframe or video element (video lazy loading is on by default)
What to do
Check that you run a version newer than 4.2.18, and read the vendor's advisory. No fixed version is named in the sources.
Products and platforms
CVE IDs
Times
First published
First seen