CVE-2026-119070

Name of the Vulnerable Software and Affected Versions Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress versions prior to 4.2.18

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages via the comment parameter. These scripts execute when a user accesses the affected page. The issue requires the plugin to be in its normal connected state with cdn key and cdn secret configured and the image replacer enabled. The payload bypasses WordPress comment sanitization filters because it contains no HTML metacharacters during storage; the characters are generated by the plugin's own decoder during rendering.

Recommendations Update the plugin to version 4.2.18 or later.