Plugin icon

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

optimole-wp

Vulnerabilities:

12

Last Updated:

October 1, 2026

Active Installs:

200000

Published
Title
Fixed in
CVSS
Published
2026-10-05
Title
Optimole 4.0.0 - 4.2.14 - Subscriber+ Sensitive Data Disclosure via Dashboard Widget
Fixed in
Fixed in 4.2.15
CVSS
6.5 (medium)
Published
2026-09-30
Title
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization < 4.2.15 - Missing Authorization
Fixed in
Fixed in 4.2.15
CVSS
4.3 (medium)
Published
2026-09-24
Title
Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block
Fixed in
Fixed in 4.2.13
CVSS
6.8 (medium)
Published
2026-09-14
Title
Optimole < 4.2.12 - Unauthenticated Stored XSS via Srcset Descriptor Parameter
Fixed in
Fixed in 4.2.12
CVSS
8.8 (high)
Published
2026-08-27
Title
Optimole < 4.2.11 - Unauthenticated Stored XSS via 'a' (above_fold_images) Parameter
Fixed in
Fixed in 4.2.11
CVSS
7.2 (high)
Published
2026-06-30
Title
Optimole < 4.2.8 - Unauthenticated Stored Cross-Site Scripting
Fixed in
Fixed in 4.2.8
CVSS
7.2 (high)
Published
2026-06-17
Title
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization < 4.2.7 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
Fixed in
Fixed in 4.2.7
CVSS
4.3 (medium)
Published
2026-04-10
Title
Optimole < 4.2.4 - Reflected Cross-Site Scripting via Page Profiler URL
Fixed in
Fixed in 4.2.4
CVSS
6.1 (medium)
Published
2026-04-10
Title
Optimole < 4.2.3 - Unauthenticated Stored XSS via Srcset Descriptor Parameter
Fixed in
Fixed in 4.2.3
CVSS
8.8 (high)
Published
2025-10-17
Title
Image optimization service by Optimole < 4.1.1 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload
Fixed in
Fixed in 4.1.1
CVSS
4.3 (medium)
Published
2024-05-14
Title
Image Optimization by Optimole < 3.13.0 - Author+ Stored Cross-Site Scripting via SVG Upload
Fixed in
Fixed in 3.13.0
CVSS
6.4 (medium)
Published
2022-03-21
Title
Image optimization & Lazy Load < 3.3.2 - Admin+ Stored Cross-Site Scripting
Fixed in
Fixed in 3.3.2
CVSS
3.4 (low)