Optimole · Optimole – Optimize Images In Real Time · CVE-2026-5226
**Name of the Vulnerable Software and Affected Versions**
Optimole – Optimize Images in Real Time versions prior to 4.2.4
**Description**
Reflected Cross-Site Scripting occurs via URL paths due to insufficient output escaping in the `get current url()` function. User-supplied URL paths are inserted into JavaScript code via `str replace()` without proper JavaScript context escaping in the `replace content()` function. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user is tricked into clicking a malicious link.
**Recommendations**
Update to version 4.2.4 or later.