The vulnerability resides in the Optimole WordPress plugin before version 4.2.12, where user‑supplied input is not properly escaped before being inserted into an image tag attribute. This flaw permits unauthenticated users to inject arbitrary attributes, resulting in stored cross‑site scripting that will be executed for every visitor to the site. Because the attack payload is persisted, any attacker who can add an image descriptor can compromise all users who view affected pages.

The issue affects installations of the Optimole plugin older than version 4.2.12. The plugin is commonly used on WordPress sites to optimize image delivery. The specific affected component is the image tag rendering logic that builds an HTML image element from srcset descriptor parameters supplied by the site administrator or plugin itself.

The CVSS score is not disclosed, and the EPSS score indicates an exploitation probability of less than 1%, so the likelihood of widespread exploitation appears low at present. However, the vulnerability qualifies as a stored XSS that could be leveraged to steal credentials, deface sites, or serve malware to all users. It is not currently listed in the CISA KEV catalog. The likely attack vector is exploitation by unauthenticated users sending crafted requests that introduce malicious attributes into the srcset field.