WordPress plugin

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization security & vulnerabilities

Q: Does Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization have known vulnerabilities?

Yes. VulnCrest Radar lists 16 known vulnerabilities in Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization: 7 high, 9 medium. None are known to affect version null.

Q: How do I check which version of Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

Q: What is the most recent Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization vulnerability?

CVE-2026-120739, published Nov 6, 2026: Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor. Severity: High (CVSS 7.2).

Q: Is any Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization vulnerability listed in CISA KEV?

No. None of the known Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization vulnerabilities is currently listed in the CISA KEV catalog.

optimole-wp— active installsLast vulnerability Nov 6, 2026

No known unpatched vulnerabilities in the latest version

All 16 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.

Watch plugin

16Known vulnerabilities

Critical0
High7
Medium9
Low0

Vulnerabilities per year

All Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization vulnerabilities

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization vulnerabilities
Severity	Vulnerability	CVE	Published
High7.2	Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor ≤4.2.18Update to 4.2.19	CVE-2026-120739	Nov 06
High7.2	Unauthenticated Stored Cross-Site Scripting via Comment Content ≤4.2.18Update to 4.2.19	CVE-2026-120677	Nov 06
High7.2	Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer ≤4.2.17Update to 4.2.18	CVE-2026-119070	Nov 06
Medium4.3	4.2.14 - Authenticated (Subscriber+) Information Exposure 4.0.0 – 4.2.14Update to 4.2.15	CVE-2026-96530	Oct 05
Medium4.3	Missing Authorization ≤4.2.14Update to 4.2.15	CVE-2026-102375	Sep 30
Medium6.4	4.2.12 - Authenticated (Author+) Stored Cross-Site Scripting 4.0.0 – 4.2.12Update to 4.2.13	CVE-2026-96531	Sep 24
High7.2	Unauthenticated Stored Cross-Site Scripting ≤4.2.11Update to 4.2.12	CVE-2026-84829	Sep 14
High7.2	Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter ≤4.2.10Update to 4.2.11	CVE-2026-77365	Aug 27
High7.2	Unauthenticated Stored Cross-Site Scripting ≤4.2.7Update to 4.2.8	CVE-2026-57673	Jun 30
Medium4.3	Cross-Site Request Forgery via 'optml_replace_file' AJAX Action ≤4.2.6Update to 4.2.7	CVE-2026-11784	Jun 17
High7.2	Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter ≤4.2.2Update to 4.2.3	CVE-2026-5217	Apr 10
Medium6.1	Reflected Cross-Site Scripting via Page Profiler URL ≤4.2.3Update to 4.2.4	CVE-2026-5226	Apr 10
Medium4.3	Insecure Direct Object Reference to Authenticated (Author+) Media Offload ≤4.1.0Update to 4.1.1	CVE-2025-11519	Oct 17, 2025
Medium6.4	Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload ≤3.12.10Update to 3.13.0	CVE-2024-4636	May 14, 2024
Medium5.3	Missing Authorization ≤2.6.9Update to 2.6.10	CVE-2024-1047	Feb 1, 2024
Medium4.8	Admin+ Stored Cross-Site Scripting <3.3.2Update to 3.3.2	CVE-2022-0969	Mar 21, 2022

High7.2
Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor
≤4.2.18Update to 4.2.19
CVE-2026-120739Nov 06
High7.2
Unauthenticated Stored Cross-Site Scripting via Comment Content
≤4.2.18Update to 4.2.19
CVE-2026-120677Nov 06
High7.2
Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer
≤4.2.17Update to 4.2.18
CVE-2026-119070Nov 06
Medium4.3
4.2.14 - Authenticated (Subscriber+) Information Exposure
4.0.0 – 4.2.14Update to 4.2.15
CVE-2026-96530Oct 05
Medium4.3
Missing Authorization
≤4.2.14Update to 4.2.15
CVE-2026-102375Sep 30
Medium6.4
4.2.12 - Authenticated (Author+) Stored Cross-Site Scripting
4.0.0 – 4.2.12Update to 4.2.13
CVE-2026-96531Sep 24
High7.2
Unauthenticated Stored Cross-Site Scripting
≤4.2.11Update to 4.2.12
CVE-2026-84829Sep 14
High7.2
Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter
≤4.2.10Update to 4.2.11
CVE-2026-77365Aug 27
High7.2
Unauthenticated Stored Cross-Site Scripting
≤4.2.7Update to 4.2.8
CVE-2026-57673Jun 30
Medium4.3
Cross-Site Request Forgery via 'optml_replace_file' AJAX Action
≤4.2.6Update to 4.2.7
CVE-2026-11784Jun 17
High7.2
Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter
≤4.2.2Update to 4.2.3
CVE-2026-5217Apr 10
Medium6.1
Reflected Cross-Site Scripting via Page Profiler URL
≤4.2.3Update to 4.2.4
CVE-2026-5226Apr 10
Medium4.3
Insecure Direct Object Reference to Authenticated (Author+) Media Offload
≤4.1.0Update to 4.1.1
CVE-2025-11519Oct 17, 2025
Medium6.4
Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload
≤3.12.10Update to 3.13.0
CVE-2024-4636May 14, 2024
Medium5.3
Missing Authorization
≤2.6.9Update to 2.6.10
CVE-2024-1047Feb 1, 2024
Medium4.8
Admin+ Stored Cross-Site Scripting
<3.3.2Update to 3.3.2
CVE-2022-0969Mar 21, 2022

Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization: common questions

Does Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization have known vulnerabilities?

Yes. VulnCrest Radar lists 16 known vulnerabilities in Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization: 7 high, 9 medium. None are known to affect version null.

How do I check which version of Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization vulnerability?

CVE-2026-120739, published Nov 6, 2026: Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor. Severity: High (CVSS 7.2).

Is any Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization vulnerability listed in CISA KEV?

No. None of the known Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization vulnerabilities is currently listed in the CISA KEV catalog.