A critical stored Cross-Site Scripting vulnerability in the Optimole WordPress plugin allows unauthenticated attackers to inject malicious scripts into pages viewed by site visitors.

This is a stored Cross-Site Scripting (XSS) flaw (CWE-79) occurring because the plugin fails to sanitize user input before rendering it within image tag attributes. The vulnerability is exploitable by unauthenticated users.

Successful exploitation permits an attacker to execute arbitrary JavaScript in the browsers of site visitors, potentially leading to session hijacking, credential theft, or unauthorized redirection. With a CVSS score of 8.8, this high-severity flaw poses a significant risk to user privacy and organizational integrity, as it can be used to compromise the trust of the entire user base.

Immediate Action: Update the Optimole WordPress plugin to version 4.2.12 or higher immediately to resolve the sanitization failure.

Proactive Monitoring: Review web server access logs for anomalous requests containing script-like patterns directed at image-related parameters.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block common XSS payloads in request parameters.

Public Exploit Available: No — there is no confirmed public exploit available.

Given the high CVSS score and the potential for widespread impact on site visitors, organizations should prioritize this update. Administrators must verify that all instances of the Optimole plugin are patched to version 4.2.12 to eliminate the XSS vector and secure the application against potential injection attacks.