Stored Cross-Site Scripting in Optimole Image Optimization Plugin for WordPress
CVE-2026-120739

7.2HIGH

Key Information:

Vendor

WordPress
Status
Optimole – Optimize Images | Convert Webp & Avif | Cdn & Lazy Load | Image Optimization
Vendor
CVE Published:
7 November 2026

What is CVE-2026-120739?

The Optimole Image Optimization plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) vulnerabilities across all versions up to 4.2.18. This arises from inadequate input sanitization and output escaping, allowing unauthenticated attackers to inject malicious web scripts into pages. These scripts execute when users access the compromised pages. Additionally, the HMAC signature necessary for authorization checks at the REST endpoint is exposed in plaintext, further diminishing security by providing unauthorized individuals with easy access to bypass the authentication barrier.

Affected Version(s)

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization 0 <= 4.2.18

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/optimole-wp/ta...
https://plugins.trac.wordpress.org/browser/optimole-wp/ta...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Mohamed Amgad Khater (mamgad)
.