Skip to content
Sign in
8.8 High

CVE-2026-84829 The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build…

Description

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.

Affected products and versions

Product Affected versions Fixed in
Optimole 4.2 4.2.3 → < 4.2.12 4.2.12

Other CVEs of Optimole

The 3 CVEs of Optimole →
CVE-2026-96530 The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored… 6.5 Medium CVE-2026-96531 The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before… 6.8 Medium
Track this CVE