The vulnerability allows an unauthenticated attacker to store malicious JavaScript in the plugin’s page profiler srcset data. Because the parameter is not sanitized or escaped, the stored code executes in the browser of any visitor who loads the affected page, leading to injection of arbitrary client‑side scripts and potential credential theft or defacement. The flaw is rooted in improper input handling (CWE‑79).

The flaw affects WordPress sites that have the Optimole plugin installed with a version of 4.2.18 or earlier. The plugin provides image optimization, WebP and AVIF conversion, CDN delivery, lazy loading and page profiling. Any environment using the plugin prior to the fixed release is vulnerable.

With a base CVSS score of 7.2, the vulnerability is moderately high in severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the lack of authentication on the REST endpoint and the public exposure of the HMAC signature remove any practical barrier for attackers. An attacker can exploit the flaw by inserting malicious srcset descriptors that persist in the profile and are served to all users.