What is the CVSS score of CVE-2026-57673?

CVE-2026-57673 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Optimole are affected by CVE-2026-57673?

WordPress installations running Optimole image-optimization plugin versions 4.2.7 and earlier are vulnerable to cross-site scripting (CVE-2026-57673) that allows unauthenticated attackers to inject…

How to fix or mitigate CVE-2026-57673?

Within 24 hours: Identify all WordPress instances using Optimole plugin and determine current installed versions; assess impact across production and customer-facing environments. Within 7 days: Disable Optimole plugin on all affected systems; migrate to alternative image-optimization solutions; deploy WAF rules to filter XSS payloads; restrict plugin configuration access to essential personnel. Within 30 days: Monitor Optimole plugin releases and vendor security advisories for patch availability; maintain staging procedures for rapid deployment once patch released.

Optimole CVE-2026-57673

EUVD-2026-41284 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-02 Patchstack

GHSA-jv93-qw89-pf3m

WordPress XSS Wordpress Plugin Optimole

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Unauthenticated network injection (PR:N/AV:N) requiring victim interaction (UI:R); XSS crosses into the browser context (S:C) with limited session-level C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 02, 2026 - 12:20 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.

AnalysisAI

Stored/reflected Cross-Site Scripting in the Optimole WordPress image-optimization plugin (versions 4.2.7 and earlier) lets remote unauthenticated attackers inject arbitrary JavaScript that executes in the browser of any user who views the affected content. Reported by Patchstack and classified CWE-79 with a CVSS 3.1 score of 7.1, the flaw carries a scope-changing impact (S:C) but requires victim interaction (UI:R). At the time of analysis there is no public exploit identified and the issue is not listed in CISA KEV; no EPSS value was supplied.

Technical ContextAI

Optimole is a widely used WordPress plugin that offloads, optimizes, and lazy-loads images through a cloud CDN. The vulnerability is a CWE-79 Cross-Site Scripting weakness, meaning attacker-controlled input is rendered into an HTML/JavaScript context without adequate output encoding or input sanitization. Because the CVSS vector marks PR:N and UI:R with a scope change (S:C), the injected payload crosses the trust boundary of the vulnerable plugin to execute in the security context of the browsing user's WordPress session. The only CPE provided is cpe:2.3:a:optimole:optimole:*:*:*:*:*:*:*:* with no upper-version boundary encoded, so the affected range is defined by the human-readable description (<= 4.2.7) rather than by the CPE itself.

RemediationAI

Upgrade Optimole to a release newer than 4.2.7; the exact fixed version was not included in the provided data, so treat the patched build as unconfirmed and verify it against the vendor changelog before deploying (No vendor-released patch version identified at time of analysis). Track the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/optimole-wp/vulnerability/wordpress-optimole-plugin-4-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve for the confirmed fixed release. Until you can update, place the affected pages behind a Web Application Firewall with XSS filtering (Patchstack or equivalent virtual patching), which blocks common injection payloads at the cost of possible false positives on legitimate rich content; alternatively, deactivate the Optimole plugin if image optimization can be temporarily suspended, accepting the trade-off of losing CDN offload and lazy-loading and thus slower image delivery.