The Optimole – Optimize Images in Real Time plugin for WordPress is vulnerable to a reflected cross‑site scripting (XSS) flaw. Insufficient escaping of user‑supplied URL paths in the get_current_url() function leads to arbitrary JavaScript being injected into the page. An attacker can insert malicious code that will run in the browser of anyone who visits the crafted URL, potentially enabling cookie theft, session hijacking, defacement or other client‑side compromise.

Any WordPress installation that uses the Optimole plugin, version 4.2.3 or earlier, is affected. The flaw resides in the page profiler URL handling within the plugin’s admin and manager modules. Users of these versions should assume the entire WordPress site is vulnerable to XSS through that specific endpoint.

The CVSS score of 6.1 indicates a medium severity vulnerability. An unauthenticated attacker can exploit it via a crafted link that a victim clicks, without needing special permissions. EPSS data is not available, and the flaw is not currently listed in the CISA KEV catalog, but the lack of exploitation data does not eliminate risk. The vulnerability is exploitable in a true web‑based environment and can be triggered remotely by any user who follows the malicious link.