Plugin icon

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

optimole-wp

Vulnerabilities:

7

Last Updated:

August 20, 2026

Active Installs:

200000

Published
Title
Fixed in
CVSS
Published
2026-06-30
Title
Optimole < 4.2.8 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 4.2.8
CVSS
7.2 (high)
Published
2026-06-17
Title
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization < 4.2.7 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
Fixed in
Fixed in 4.2.7
CVSS
4.3 (medium)
Published
2026-04-10
Title
Optimole < 4.2.4 - Reflected Cross-Site Scripting via Page Profiler URL
Fixed in
Fixed in 4.2.4
CVSS
6.1 (medium)
Published
2026-04-10
Title
Optimole < 4.2.3 - Unauthenticated Stored XSS via Srcset Descriptor Parameter
Fixed in
Fixed in 4.2.3
CVSS
8.8 (high)
Published
2025-10-17
Title
Image optimization service by Optimole < 4.1.1 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload
Fixed in
Fixed in 4.1.1
CVSS
4.3 (medium)
Published
2024-05-14
Title
Image Optimization by Optimole < 3.13.0 - Author+ Stored Cross-Site Scripting via SVG Upload
Fixed in
Fixed in 3.13.0
CVSS
6.4 (medium)
Published
2022-03-21
Title
Image optimization & Lazy Load < 3.3.2 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 3.3.2
CVSS
3.4 (low)