The Optimole WordPress plugin contains a stored cross‑site scripting flaw that allows an unauthenticated attacker to inject arbitrary web scripts via the 's' (srcset descriptor) parameter of the /wp-json/optimole/v1/optimizations REST endpoint. Because the plugin stores the descriptor in a transient without proper escaping, the malicious script is later retrieved and inserted verbatim into the srcset attribute of image tags. As a result, any visitor viewing a page that includes a processed image will have the injected script executed in their browser.

Any WordPress site that has the Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin installed in version 4.2.2 or earlier is affected. The vulnerability exists in all releases up to and including 4.2.2.

The CVSS score of 7.2 indicates a high severity flaw. The REST endpoint is accessible without authentication, so an attacker only needs to craft a single request with a malicious srcset descriptor and an HMAC timestamp pair that is exposed on the front end, making exploitation straightforward. Because of the lack of an authentication requirement and no public exploitation data, the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the combination of a high severity score and low barrier to entry presents a significant risk to sites that have not been patched.