Optimole vulnerabilities

Products

• Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization 5
• Optimole – Optimize Images in Real Time 5
• Super Page Cache 3
• Optimole 2
• Super Page Cache for Cloudflare 1

Latest Optimole CVEs

Newest publication first

1. CVE-2026-120677 Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment Content

   Published 2026-11-07

   High·CVSS 7.2 EPSS 0.30%

   The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanitization and output...

2. CVE-2026-120739 Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor

   Published 2026-11-07

   High·CVSS 7.2 EPSS 0.34%

   The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 's (missing_srcsets[][].s)' parameter in all versions up to, and including, 4.2.18 due to insufficient input sanit...

3. CVE-2026-119070 Optimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer

   Published 2026-11-07

   High·CVSS 7.2 EPSS 0.26%

   The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.2.17 due to insufficient input sanitization and output...

4. CVE-2026-102375 WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability

   Published 2026-09-30

   Medium·CVSS 6.5 EPSS 0.26%

   Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimole: from n/a through 4.2.14.

5. CVE-2026-77365 Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter

   Published 2026-08-28

   High·CVSS 7.2 EPSS 0.53%

   The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitizat...

6. CVE-2026-57673 WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability

   Published 2026-07-02

   High·CVSS 7.1 EPSS 0.25%

   Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.

7. CVE-2026-11784 Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action

   Published 2026-06-18

   Medium·CVSS 4.3 EPSS 0.23%

   The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file funct...

8. CVE-2026-5217 Optimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter

   Published 2026-04-11

   High·CVSS 7.2 EPSS 0.46%

   The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.2. This is due to insufficient input sanitization and output escaping on the use...

9. CVE-2026-5226 Optimole <= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URL

   Published 2026-04-11

   Medium·CVSS 6.1 EPSS 0.50%

   The Optimole – Optimize Images in Real Time plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL paths in versions up to, and including, 4.2.3 This is due to insufficient output escaping on user-supplied URL paths in the get_current_url() function, which a...

10. CVE-2026-1843 Super Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity Log

    Published 2026-02-14

    High·CVSS 7.2 EPSS 0.23%

    The Super Page Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Activity Log in all versions up to, and including, 5.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbit...

11. CVE-2025-11519 Image optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload

    Published 2025-10-18

    Medium·CVSS 4.3 EPSS 0.34%

    The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the /wp-json/optml/v1/move_image REST API endpoint due to missing val...

12. CVE-2024-4636 Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload

    Published 2024-05-15

    Medium·CVSS 6.4 EPSS 0.42%

    The Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘allow_meme_types’ function in versions up to, and including, 3.12.10 due to insufficient input sanitization and output escaping. Thi...

13. CVE-2024-27968 WordPress Super Page Cache for Cloudflare plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) to XSS vulnerability

    Published 2024-03-21

    Medium·CVSS 6.1 EPSS 0.19%

    Cross-Site Request Forgery (CSRF) vulnerability in Optimole Super Page Cache for Cloudflare allows Stored XSS.This issue affects Super Page Cache for Cloudflare: from n/a through 4.7.5.

14. CVE-2024-1047 ThemeIsle SDK <= Various Versions - Missing Authorization

    Published 2024-02-02

    Medium·CVSS 5.3 EPSS 0.56%

    Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update optio...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.