Skip to content
Sign in
6.8 Medium

CVE-2026-96531 The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before…

Description

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.

Affected products and versions

Product Affected versions Fixed in
Optimole 4.0 4.0.0 → < 4.2.13 4.2.13

Other CVEs of Optimole

The 3 CVEs of Optimole →
CVE-2026-96530 The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored… 6.5 Medium CVE-2026-84829 The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build… 8.8 High
Track this CVE