---
id: "CVE-2026-120677"
page: "https://infrastack.ai/live/CVE-2026-120677"
kind: "vulnerability"
aliases: ["CVE-2026-120677"]
title: "Optimole WordPress plugin: stored XSS via comment parameter"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["optimole", "package", "wordpress", "wp-plugin"]
not_affected_if: ["comments-disabled", "plugin-newer-than-4.2.18", "plugin-not-installed"]
published_at: "2026-11-07T04:17:13+00:00"
first_seen_at: "2026-11-07T04:45:47+00:00"
updated_at: "2026-11-07T04:47:54+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120677", "first_seen_at": "2026-11-07T04:45:47+00:00"}]
exploit_sources: []
---

# Optimole WordPress plugin: stored XSS via comment parameter

Link for people: https://infrastack.ai/live/CVE-2026-120677 (this .md is for agents)

The Optimole image optimization plugin for WordPress fails to sanitize the comment parameter, so injected scripts are stored. When an administrator approves the comment and a page contains an iframe or video element, the script runs for visitors of that page.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Optimole plugin version in the WordPress admin Plugins screen against `4.2.18`
- Look for the plugin folder `optimole-wp` under `wp-content/plugins/` and read its version header
- Review pending comments and approved comments for unexpected script content

## Fix

- Optimole WordPress plugin: move to a version later than `4.2.18` (fixed version not stated in the sources)

## Timeline

- 2026-11-07T04:45:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120677

## From the sources

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the comment to be approved by an administrator and for the affected post to contain at least one iframe or video element (e.g., a core Video block), which is sufficient under default plugin settings where video lazy loading is enabled.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_