PT-2026-32092 · Optimole · Optimole – Optimize Images In Real Time

Sencer Kılıç · Publicado 2026-04-11 · Atualizado 2026-04-11 · CVE-2026-5226

NVD

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Optimole – Optimize Images in Real Time plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL paths in versions up to, and including, 4.2.3 This is due to insufficient output escaping on user-supplied URL paths in the get current url() function, which are inserted into JavaScript code via str replace() without proper JavaScript context escaping in the replace content() function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2026-5226

Produtos afetados

Optimole – Optimize Images In Real Time

Referências · 10

• https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/manager.php#L459 · Nota
• https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/admin.php#L1012 · Nota
• https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/manager.php#L459 · Nota
• https://wordfence.com/threat-intel/vulnerabilities/id/112cea93-fa4b-4692-8c8b-e74255f61939?source=cve · Nota
• https://plugins.trac.wordpress.org/changeset/3498040/optimole-wp/trunk/inc/manager.php · Nota
• https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/admin.php#L1012 · Nota
• https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/manager.php#L542 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-5226 · Nota de Segurança
• https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/manager.php#L542 · Nota
• https://plugins.trac.wordpress.org/changeset?old_path=%2Foptimole-wp/tags/4.2.3&new_path=%2Foptimole-wp/tags/4.2.4 · Nota