A critical Stored Cross-Site Scripting vulnerability in the Optimole WordPress plugin allows unauthenticated attackers to execute malicious scripts in the context of site visitors.

The vulnerability exists due to insufficient input sanitization and output escaping on the s parameter within the REST endpoint. An unauthenticated attacker can bypass HMAC protection and inject malicious payloads into the WordPress options table, which are subsequently rendered in the browser of any visitor.

The exploitation of this vulnerability allows for unauthorized script execution on behalf of site users, which can lead to session hijacking, credential theft, or the distribution of malicious content. With a CVSS score of 7.2, the risk is classified as High, as it permits attackers to compromise the integrity of the user experience and potentially gain administrative access through session manipulation.

Immediate Action: Update the Optimole plugin to the latest available version beyond 4.2.2 immediately to ensure the input sanitization and output escaping flaws are resolved.

Proactive Monitoring: Monitor site traffic for unusual requests directed at the /wp-json/optimole/v1/optimizations endpoint and inspect page source code for unexpected JavaScript injections.

Compensating Controls: Deploy a Web Application Firewall with rules configured to block suspicious input patterns in REST API parameters to mitigate the risk of exploit attempts.

Public Exploit Available: No (exploit_available: unknown)

This vulnerability presents a significant risk to site security, particularly because it can be triggered by unauthenticated actors without requiring administrative interaction. Administrators should prioritize updating the Optimole plugin immediately to remove the vulnerable code path and prevent potential cross-site scripting attacks that could compromise site users.