EUVD-2026-21664Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Optimole - Optimize Images in Real Time plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL paths in versions up to, and including, 4.2.3 This is due to insufficient output escaping on user-supplied URL paths in the get_current_url() function, which are inserted into JavaScript code via str_replace() without proper JavaScript context escaping in the replace_content() function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
AnalysisAI
Reflected Cross-Site Scripting (XSS) in Optimole - Optimize Images in Real Time WordPress plugin versions up to 4.2.3 allows unauthenticated attackers to inject arbitrary JavaScript through malicious URL paths. The vulnerability stems from insufficient output escaping in the get_current_url() function, which are then inserted into JavaScript code via str_replace() without proper JavaScript context escaping in replace_content(). An attacker can craft a malicious link that, when clicked by a WordPress user, executes injected scripts in the context of the user's browser session with CVSS 6.1 (Medium) severity.
Technical ContextAI
The Optimole plugin processes user-supplied URL paths through the get_current_url() function without adequate output escaping. These unescaped values are subsequently embedded into JavaScript code via str_replace() in the replace_content() function, failing to apply JavaScript-specific escaping (such as JSON encoding or proper quote/special character handling). This violates the fundamental principle of context-aware output encoding-while HTML entity encoding may be applied, JavaScript context requires different escaping rules. CWE-79 (Improper Neutralization of Input During Web Page Generation) categorizes this as a classic reflected XSS vulnerability. The affected CPE cpe:2.3:a:optimole:optimole_-_optimize_images_in_real_time:*:*:*:*:*:*:*:* indicates all versions of the plugin are potentially impacted, with confirmed vulnerability through version 4.2.3.
RemediationAI
Update the Optimole - Optimize Images in Real Time plugin to version 4.2.4 or later, which resolves the XSS vulnerability by implementing proper JavaScript context escaping in the get_current_url() and replace_content() functions. Users should immediately apply this patch via the WordPress plugin update mechanism (Plugins > Installed Plugins > Update Available). For environments where immediate patching is not feasible, temporarily disable the Optimole plugin until patched versions can be deployed. Verify the update completion by confirming the installed version matches 4.2.4 or higher in the WordPress plugin management interface. Additional information and confirmation of the fix is available via the WordPress plugin repository changeset reference: https://plugins.trac.wordpress.org/changeset?old_path=%2Foptimole-wp/tags/4.2.3&new_path=%2Foptimole-wp/tags/4.2.4
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today