Optimole WordPress plugin stored XSS flaw

Malicious scripts can be planted in your site visitors' browsers.

Summary

Insufficient input sanitization in the Optimole image optimization plugin for WordPress lets unauthenticated attackers inject web scripts into pages. The scripts run for any user who opens an injected page. All versions up to and including 4.2.18 are affected.

What to do

No fixed version is named in the sources. Check that the installed plugin is newer than 4.2.18 and read the vendor's advisory.

Products and platforms

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

CVE IDs

CVE-2026-120739 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-07 03:28 UTC

First seen 2026-11-09 18:40 UTC