Optimole <= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URL
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Optimole – Optimize Images in Real Time plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL paths in versions up to, and including, 4.2.3 This is due to insufficient output escaping on user-supplied URL paths in the get_current_url() function, which are inserted into JavaScript code via str_replace() without proper JavaScript context escaping in the replace_content() function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-5226
- 2026-10-03 Alias added: GHSA-c2rf-g3vq-gg84
References
Other 9
- https://www.wordfence.com/threat-intel/vulnerabilities/id/112cea93-fa4b-4692-8c8b-e74255f61939?source=cve
- https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/manager.php#L459
- https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/manager.php#L459
- https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/manager.php#L542
- https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/manager.php#L542
- https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/admin.php#L1012
- https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/admin.php#L1012
- https://plugins.trac.wordpress.org/changeset/3498040/optimole-wp/trunk/inc/manager.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Foptimole-wp/tags/4.2.3&new_path=%2Foptimole-wp/tags/4.2.4
More optimole vulnerabilities
- TI-2026-04558 Optimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter CVSS 3.1HIGH 7.2
- TI-2026-01518 Super Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity Log CVSS 3.1HIGH 7.2
- TI-2026-86193 Stored cross-site scripting in Optimole WordPress plugin CVSS 3.1HIGH 7.2
- TI-2026-53980 Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter CVSS 3.1HIGH 7.2
- TI-2026-86192 Stored cross-site scripting in Optimole WordPress plugin via comments CVSS 3.1HIGH 7.2
- TI-2026-86170 Stored cross-site scripting in Optimole WordPress plugin CVSS 3.1HIGH 7.2
Sources
- CVE-2026-5226 · CVE Program
- CVE-2026-5226 · NVD
- FIRST EPSS
- GHSA-c2rf-g3vq-gg84 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences