PT-2026-32092 · Optimole · Optimole – Optimize Images In Real Time

Published 2026-04-11 · Updated 2026-04-11 · CVE-2026-5226

NVD

CVSS v3.1

6.1

Medium

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

The Optimole – Optimize Images in Real Time plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL paths in versions up to, and including, 4.2.3 This is due to insufficient output escaping on user-supplied URL paths in the get current url() function, which are inserted into JavaScript code via str replace() without proper JavaScript context escaping in the replace content() function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-5226

Affected Products

Optimole – Optimize Images In Real Time

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-5226 · Security Note
• https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/manager.php#L459 · Note
• https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/admin.php#L1012 · Note
• https://plugins.trac.wordpress.org/changeset/3498040/optimole-wp/trunk/inc/manager.php · Note
• https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/manager.php#L459 · Note
• https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/admin.php#L1012 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/112cea93-fa4b-4692-8c8b-e74255f61939?source=cve · Note
• https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/manager.php#L542 · Note
• https://plugins.trac.wordpress.org/changeset?old_path=%2Foptimole-wp/tags/4.2.3&new_path=%2Foptimole-wp/tags/4.2.4 · Note
• https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/manager.php#L542 · Note