---
id: "CVE-2026-120739"
page: "https://infrastack.ai/live/CVE-2026-120739"
kind: "vulnerability"
aliases: ["CVE-2026-120739"]
title: "Optimole WordPress plugin: unauthenticated stored script injection via image srcsets"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "optimole-wp", "fixed": ["4.2.19"], "affected": "<= 4.2.18", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["optimole", "package", "php", "plugin", "unauthenticated", "wordpress", "xss"]
not_affected_if: ["plugin-not-installed", "plugin-updated"]
published_at: "2026-11-07T04:17:13+00:00"
first_seen_at: "2026-11-07T04:45:47+00:00"
updated_at: "2026-11-07T04:49:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120739", "first_seen_at": "2026-11-07T04:45:47+00:00"}, {"source": "analyst", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/optimole-wp/optimole-4218-unauthenticated-stored-cross-site-scripting-via-page-profiler-srcset-descriptor", "first_seen_at": "2026-11-07T04:49:04+00:00", "cites": ["https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/optimole-wp/optimole-4218-unauthenticated-stored-cross-site-scripting-via-page-profiler-srcset-descriptor", "https://wpsec.com/vuln/WPSEC-2026-2623/"]}]
exploit_sources: []
---

# Optimole WordPress plugin: unauthenticated stored script injection via image srcsets

Link for people: https://infrastack.ai/live/CVE-2026-120739 (this .md is for agents)

The Optimole image optimization plugin for WordPress fails to sanitize the missing_srcsets parameter, so an unauthenticated attacker can store arbitrary scripts that run in the browser of anyone who opens an affected page. The plugin also exposes the HMAC signature needed to pass its REST endpoint check in page source, removing the authentication barrier.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:optimole-wp affected <= 4.2.18 fixed 4.2.19

## How to check

- In WordPress admin > Plugins, check the Optimole version; 4.2.18 and earlier are affected, 4.2.19 is the patched release per Wordfence.
- Or run: wp plugin get optimole-wp --field=version
- View page source for the inline optimoleDataOptimizer object (exposes the HMAC); present on pages with an incomplete profile.

## Fix

Update the Optimole plugin (optimole-wp) to 4.2.19 or later.

## Timeline

- 2026-11-07T04:45:47+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120739
- 2026-11-07T04:49:04+00:00 analyst https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/optimole-wp/optimole-4218-unauthenticated-stored-cross-site-scripting-via-page-profiler-srcset-descriptor — Wordfence (researcher mamgad, published 2026-11-06) lists patched version 4.2.19, affected <= 4.2.18; WPSec shows 4.2.19 released 2026-11-04 for a sibling Optimole issue. No vendor changelog or wordpress.org advisory could be read (changelog tab not in fetched text), so nothing marked verified. No exploitation or PoC found. X not searched. Sibling CVE-2026-120677 (comment XSS) has the same affected range.

## Documents

- [advisory] Optimole <= 4.2.18 - Unauthenticated Stored XSS via Page Profiler srcset Descriptor (Wordfence) https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/optimole-wp/optimole-4218-unauthenticated-stored-cross-site-scripting-via-page-profiler-srcset-descriptor
- [mentions] WPSec: Optimole <= 4.2.18 Contributor+ stored XSS, fixed in 4.2.19 https://wpsec.com/vuln/WPSEC-2026-2623/

## From the sources

The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's (missing_srcsets[*][*].s)' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The HMAC signature required to pass the REST endpoint's authorization check is published in plaintext to unauthenticated visitors inside the inline optimoleDataOptimizer JavaScript object on any page with an incomplete profile, making the effective authentication barrier nonexistent.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_