Stored Cross-Site Scripting in Optimole Plugin for WordPress

CVE-2026-5217

What is CVE-2026-5217?

The Optimole plugin for WordPress is vulnerable to a Stored Cross-Site Scripting attack due to insufficient input sanitization of the 's' parameter in the REST endpoint /wp-json/optimole/v1/optimizations. This vulnerability allows unauthenticated attackers to execute arbitrary web scripts on affected sites. The issue arises because the plugin stores the user-supplied descriptor without proper escaping, allowing malicious scripts to be injected into the srcset attribute on pages viewed by users. Proper security practices must be adopted to prevent such vulnerabilities, emphasizing the importance of thorough input validation and output sanitization.

References