OPTIMOLE-WP · CVE-2026-120739 · Package
FIX → 4.2.19
The Optimole image optimization plugin for WordPress fails to sanitize the missing_srcsets parameter, so an unauthenticated attacker can store arbitrary scripts that run in the browser of anyone who opens an affected page. The plugin also exposes the HMAC signature needed to pass its REST endpoint check in page source, removing the authentication barrier.
first public Nov 7, 2026 · 2 sources
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Optimole plugin for WordPress at version 4.2.18 or earlier are exposed, and the exposure is worst where the Optimole profile is incomplete because the signature is then printed on public pages. Sites without the plugin, or running a newer version, are not affected according to the sources. The sources do not say whether a fixed version exists.
Not affected if plugin-not-installed, plugin-updated
Who cares optimole, php, plugin, unauthenticated, wordpress, xss
Upgrade to 4.2.19
Update the Optimole plugin (optimole-wp) to 4.2.19 or later.
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's (missing_srcsets[][].s)' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The HMAC signature required to pass the REST endpoint's authorization check is published in plaintext to unauthenticated visitors inside the inline optimoleDataOptimizer JavaScript object on any page with an incomplete profile, making the effective authentication barrier nonexistent.
This page as ·
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.