CVE-2026-57673 - Vulnerability Details

Description

Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.

Published: 2026-07-02

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

Unauthenticated Cross Site Scripting in the WordPress Optimole plugin allows an attacker to inject malicious scripts that execute in the browsers of users who view affected content. This vulnerability is classified as CWE‑79.

Affected Systems

The affected software is the WordPress Optimole plugin, a popular image optimization tool. Any WordPress installation running Optimole version 4.2.7 or earlier is susceptible. No specific WordPress core version is required for exploitation.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by submitting a crafted request that injects script code, which is then rendered in the browser of unauthenticated visitors or site administrators, making the vulnerability actionable even without privileged access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Optimole

unaffected

Version	Status	Constraints
`n/a`	affected	≤ 4.2.7

No data.

No data available yet.

Remediation

Vendor Solution

Update the WordPress Optimole Plugin to the latest available version (at least 4.2.8).

OpenCVE Recommended Actions

Update the Optimole plugin to version 4.2.8 or later.
If a patch cannot be applied immediately, disable the plugin or remove it from active WordPress installations until the update is available.
Deploy a Web Application Firewall rule that blocks or sanitizes common XSS payloads targeting the Optimole plugin interface.

Generated by OpenCVE AI on July 3, 2026 at 10:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00191.

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://patchstack.com/database/wordpress/plugin/optimole-wp/vulnerability/wordpress-optimole-plugin-4-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve

History

Thu, 02 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Thu, 02 Jul 2026 11:30:00 +0000

Type	Values Removed	Values Added
Description		Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.
Title		WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability
Weaknesses		CWE-79
References		https://patchstack.com/database/wordpress/plugin/optimole-wp/vulnerability/wordpress-optimole-plugin-4-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}`

Subscriptions

No data.

MITRE

Status: PUBLISHED

Assigner: Patchstack

Published: 2026-07-02T11:15:32.255Z

Updated: 2026-07-02T19:39:29.404Z

Reserved: 2026-06-25T08:03:37.652Z

Link: CVE-2026-57673

Vulnrichment

Updated: 2026-07-02T19:39:23.375Z

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-07-03T10:30:11Z

Weaknesses

CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-57673", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-06-25T08:03:37.652Z", "datePublished": "2026-07-02T11:15:32.255Z", "dateUpdated": "2026-07-02T19:39:29.404Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-07-02T11:27:03.742Z"}, "title": "WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability", "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "impacts": [{"capecId": "CAPEC-588", "descriptions": [{"lang": "en", "value": "CAPEC-588 DOM-Based XSS"}]}], "affected": [{"vendor": "Optimole", "defaultStatus": "unaffected", "product": "Optimole", "versions": [{"lessThanOrEqual": "4.2.7", "status": "affected", "version": "n/a", "versionType": "custom", "changes": [{"at": "4.2.8", "status": "unaffected"}]}]}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions."}], "value": "Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions."}], "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/optimole-wp/vulnerability/wordpress-optimole-plugin-4-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "LOW", "version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L"}}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the WordPress Optimole Plugin to the latest available version (at least 4.2.8)."}], "value": "Update the WordPress Optimole Plugin to the latest available version (at least 4.2.8)."}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "daroo | Patchstack Bug Bounty Program"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-02T19:37:26.124147Z", "id": "CVE-2026-57673", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-02T19:39:29.404Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-57673", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-02T19:37:26.124147Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-02T19:39:23.375Z"}}], "cna": {"title": "WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "daroo | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-588", "descriptions": [{"lang": "en", "value": "CAPEC-588 DOM-Based XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.1, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Optimole", "product": "Optimole", "versions": [{"status": "affected", "changes": [{"at": "4.2.8", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "4.2.7"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress Optimole Plugin to the latest available version (at least 4.2.8).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress Optimole Plugin to the latest available version (at least 4.2.8).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/optimole-wp/vulnerability/wordpress-optimole-plugin-4-2-7-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.", "supportingMedia": [{"type": "text/html", "value": "Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-07-02T11:27:03.742Z"}}}, "cveMetadata": {"cveId": "CVE-2026-57673", "state": "PUBLISHED", "dateUpdated": "2026-07-02T19:39:29.404Z", "dateReserved": "2026-06-25T08:03:37.652Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-07-02T11:15:32.255Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact Low

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object