Aller au contenu
Se connecter
6.8 Moyenne

CVE-2026-96531 The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before…

Description

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.

Produits et versions touchés

Produit Versions touchées Corrigé en
Optimole 4.0 4.0.0 → < 4.2.13 4.2.13

Autres CVE de Optimole

Les 3 CVE de Optimole →
CVE-2026-96530 The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored… 6.5 Moyenne CVE-2026-84829 The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build… 8.8 Élevée
Suivre cette CVE