Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.15 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
- ID
- WPSEC-2026-0156
- Plugin
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization (optimole-wp)
- Affected
- from 3.6.0 before 4.2.16
- Remediation
- Update to 4.2.16 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization on WPSec AttackSurface
- Fix released
- Published
Description
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG file uploads in versions 3.6.0 up to, and including, 4.2.15. This is due to the plugin enabling SVG uploads for all users who can upload files but only sanitizing them on the wp_handle_upload path, not for files stored through wp_handle_sideload(), such as raw-body uploads to the REST API media endpoint (/wp/v2/media). This makes it possible for authenticated attackers, with author-level access and above, to upload SVG files containing arbitrary web scripts that execute whenever a user accesses the uploaded file.
References
- https://wpsec.com/vuln/WPSEC-2026-0156/
- https://plugins.svn.wordpress.org/optimole-wp/tags/4.2.16/
- https://wordpress.org/plugins/optimole-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS