What is the CVSS score of CVE-2026-5226?

CVE-2026-5226 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-5226

EUVD-2026-21664 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-11 Wordfence

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 11, 2026 - 01:30 euvd

EUVD-2026-21664

Analysis Generated

Apr 11, 2026 - 01:30 vuln.today

CVE Published

Apr 11, 2026 - 01:24 nvd

MEDIUM 6.1

DescriptionCVE.org

The Optimole - Optimize Images in Real Time plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL paths in versions up to, and including, 4.2.3 This is due to insufficient output escaping on user-supplied URL paths in the get_current_url() function, which are inserted into JavaScript code via str_replace() without proper JavaScript context escaping in the replace_content() function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

AnalysisAI

Reflected Cross-Site Scripting (XSS) in Optimole - Optimize Images in Real Time WordPress plugin versions up to 4.2.3 allows unauthenticated attackers to inject arbitrary JavaScript through malicious URL paths. The vulnerability stems from insufficient output escaping in the get_current_url() function, which are then inserted into JavaScript code via str_replace() without proper JavaScript context escaping in replace_content(). An attacker can craft a malicious link that, when clicked by a WordPress user, executes injected scripts in the context of the user's browser session with CVSS 6.1 (Medium) severity.

Technical ContextAI

The Optimole plugin processes user-supplied URL paths through the get_current_url() function without adequate output escaping. These unescaped values are subsequently embedded into JavaScript code via str_replace() in the replace_content() function, failing to apply JavaScript-specific escaping (such as JSON encoding or proper quote/special character handling). This violates the fundamental principle of context-aware output encoding-while HTML entity encoding may be applied, JavaScript context requires different escaping rules. CWE-79 (Improper Neutralization of Input During Web Page Generation) categorizes this as a classic reflected XSS vulnerability. The affected CPE cpe:2.3:a:optimole:optimole_-_optimize_images_in_real_time:*:*:*:*:*:*:*:* indicates all versions of the plugin are potentially impacted, with confirmed vulnerability through version 4.2.3.

RemediationAI

Update the Optimole - Optimize Images in Real Time plugin to version 4.2.4 or later, which resolves the XSS vulnerability by implementing proper JavaScript context escaping in the get_current_url() and replace_content() functions. Users should immediately apply this patch via the WordPress plugin update mechanism (Plugins > Installed Plugins > Update Available). For environments where immediate patching is not feasible, temporarily disable the Optimole plugin until patched versions can be deployed. Verify the update completion by confirming the installed version matches 4.2.4 or higher in the WordPress plugin management interface. Additional information and confirmation of the fix is available via the WordPress plugin repository changeset reference: https://plugins.trac.wordpress.org/changeset?old_path=%2Foptimole-wp/tags/4.2.3&new_path=%2Foptimole-wp/tags/4.2.4