WordPress Plugin Vulnerabilities

Optimole < 4.2.8 - Unauthenticated Stored Cross-Site Scripting

Description

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping, making it possible for unauthenticated attackers to inject arbitrary web scripts that execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
optimole-wp
Fixed in 4.2.8

References

CVE
CVE-2026-57673
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/3320fe6a-dafc-4640-8d8b-7f62fc6e7753

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
daroo
Verified
No
WPVDB ID
c85d253d-a6ec-4670-bfee-587fada5df3e

Timeline

Publicly Published
2026-06-30 (about 1 month ago)
Added
2026-07-07 (about 1 month ago)
Last Updated
2026-07-07 (about 1 month ago)

Other

Published
Title
Published
2014-08-01
Title
SEO Friendly Images 2.7.4 - seo-friendly-images.php Multiple Parameters XSS
Published
2023-04-19
Title
WP Responsive Tabs horizontal vertical and accordion Tabs < 1.1.16 - Reflected Cross-Site Scripting
Published
2023-04-06
Title
Product Catalog Simple < 1.7.0 - Reflected XSS
Published
2025-05-07
Title
Multiple Plugins by wpcodefactory <= Various Versions - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-11-18
Title
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor < 3.14.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode