Veille CVE

Recherche « Optimole »

7 CVE

Critique 0 Élevée 3 Moyenne 4 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Optimole » ✕
  1. CVE-2026-96530 6.5 Moyenne

    Unknown Optimole

    The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user, including Subscribers, to read the site's third-party service credentials.

  2. CVE-2026-102375 6.5 Moyenne

    Optimole

    Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimole: from n/a through 4.2.14.

  3. CVE-2026-96531 6.8 Moyenne

    Unknown Optimole

    The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.

  4. CVE-2026-84829 8.8 Élevée

    Unknown Optimole

    The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.

  5. CVE-2026-77365 7.2 Élevée

    Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

    The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'a' (above_fold_images) parameter in all versions up to, and including, 4.2.10 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

  6. CVE-2026-57673 7.1 Élevée

    Optimole

    Unauthenticated Cross Site Scripting (XSS) in Optimole <= 4.2.7 versions.

  7. CVE-2026-11784 4.3 Moyenne

    Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

    The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.2.6. This is due to missing or incorrect nonce validation on the replace_file function. This makes it possible for unauthenticated attackers to overwrite existing media attachments with attacker-supplied file content by supplying a forged multipart POST request targeting any attachment the victim has edit_post capability over via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. The forged request requires a victim with at least Author-level privileges, as the handler enforces a current_user_can('edit_post', $id) check; tricking an Author-level or higher user into clicking a crafted link is sufficient to trigger the overwrite against attachments that user can edit.