Refine your search

2 vulnerabilities found for Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization by optimole

CVE-2026-77365 (GCVE-0-2026-77365)
Vulnerability from cvelistv5
Published
2026-08-28 02:26
Modified
2026-08-28 15:17
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE
  • CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Impacted products
Vendor Product Version
optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization Version: 0   ≤ 4.2.10
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-77365",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-28T15:16:49.246404Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-28T15:17:13.576Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Optimole \u2013 Optimize Images | Convert WebP \u0026 AVIF | CDN \u0026 Lazy Load | Image Optimization",
          "vendor": "optimole",
          "versions": [
            {
              "lessThanOrEqual": "4.2.10",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Osvaldo Noe Gonzalez Del Rio (Os)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Optimole \u2013 Optimize Images | Convert WebP \u0026 AVIF | CDN \u0026 Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the \u0027a\u0027 (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-28T02:26:56.688Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b8634a78-e0d3-4e2e-87d8-4277f56511c6?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.10/inc/v2/PageProfiler/Profile.php#L485"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.10/inc/rest.php#L935"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.10/inc/rest.php#L159"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.10/inc/manager.php#L468"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.10/inc/v2/PageProfiler/Profile.php#L189"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.7/inc/v2/PageProfiler/Profile.php#L485"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.7/inc/rest.php#L935"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.7/inc/rest.php#L159"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.7/inc/manager.php#L468"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.7/inc/v2/PageProfiler/Profile.php#L189"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3666687/optimole-wp/trunk/inc/v2/PageProfiler/Profile.php"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Foptimole-wp/tags/4.2.10\u0026new_path=%2Foptimole-wp/tags/4.2.11"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-08-20T19:54:52.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-08-27T14:09:18.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Optimole \u003c= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via \u0027a\u0027 (above_fold_images) Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-77365",
    "datePublished": "2026-08-28T02:26:56.688Z",
    "dateReserved": "2026-08-20T19:34:28.834Z",
    "dateUpdated": "2026-08-28T15:17:13.576Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-11784 (GCVE-0-2026-11784)
Vulnerability from cvelistv5
Published
2026-06-18 05:34
Modified
2026-06-18 13:03
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
CWE
  • CWE-352 - Cross-Site Request Forgery (CSRF)
Summary
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file function. This makes it possible for unauthenticated attackers to overwrite existing media attachments with attacker-supplied file content by supplying a forged multipart POST request targeting any attachment the victim has edit_post capability over via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The forged request requires a victim with at least Author-level privileges, as the handler enforces a current_user_can('edit_post', $id) check; tricking an Author-level or higher user into clicking a crafted link is sufficient to trigger the overwrite against attachments that user can edit.
References
Impacted products
Vendor Product Version
optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization Version: 0   ≤ 4.2.6
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-11784",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-06-18T13:02:59.036208Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-06-18T13:03:09.076Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Optimole \u2013 Optimize Images | Convert WebP \u0026 AVIF | CDN \u0026 Lazy Load | Image Optimization",
          "vendor": "optimole",
          "versions": [
            {
              "lessThanOrEqual": "4.2.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Alexandru Bucur"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Optimole \u2013 Optimize Images | Convert WebP \u0026 AVIF | CDN \u0026 Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file function. This makes it possible for unauthenticated attackers to overwrite existing media attachments with attacker-supplied file content by supplying a forged multipart POST request targeting any attachment the victim has edit_post capability over via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The forged request requires a victim with at least Author-level privileges, as the handler enforces a current_user_can(\u0027edit_post\u0027, $id) check; tricking an Author-level or higher user into clicking a crafted link is sufficient to trigger the overwrite against attachments that user can edit."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-352",
              "description": "CWE-352 Cross-Site Request Forgery (CSRF)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-18T05:34:25.696Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8a90de6e-6bd5-43b6-980d-84d25d4120ad?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.6/inc/media_rename/attachment_edit.php#L331"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.6/inc/media_rename/attachment_edit.php#L24"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.5/inc/media_rename/attachment_edit.php#L331"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.5/inc/media_rename/attachment_edit.php#L24"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3574315%40optimole-wp\u0026new=3574315%40optimole-wp\u0026sfp_email=\u0026sfph_mail="
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-06-09T13:03:06.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-06-17T00:00:00.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Optimole \u2013 Optimize Images | Convert WebP \u0026 AVIF | CDN \u0026 Lazy Load | Image Optimization \u003c= 4.2.6 - Cross-Site Request Forgery via \u0027optml_replace_file\u0027 AJAX Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-11784",
    "datePublished": "2026-06-18T05:34:25.696Z",
    "dateReserved": "2026-06-09T12:47:39.122Z",
    "dateUpdated": "2026-06-18T13:03:09.076Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}