CVE-2026-5226

Name of the Vulnerable Software and Affected Versions Optimole – Optimize Images in Real Time versions prior to 4.2.4

Description Reflected Cross-Site Scripting occurs via URL paths due to insufficient output escaping in the get current url() function. User-supplied URL paths are inserted into JavaScript code via str replace() without proper JavaScript context escaping in the replace content() function. This allows unauthenticated attackers to inject arbitrary web scripts that execute when a user is tricked into clicking a malicious link.

Recommendations Update to version 4.2.4 or later.