CVE-2026-77365 Overview
CVE-2026-77365 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Optimole – Optimize Images plugin for WordPress. The flaw affects all versions up to and including 4.2.10. It stems from insufficient input sanitization and output escaping on the a (above_fold_images) parameter. Unauthenticated attackers can inject arbitrary web scripts that execute when users visit an injected page.
Critical Impact
Unauthenticated attackers can persist malicious JavaScript in stored plugin data, enabling session theft, administrative account takeover, and drive-by malware delivery against site visitors.
Affected Products
- Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress
- All versions up to and including 4.2.10
- Fixed in version 4.2.11
Discovery Timeline
- 2026-08-28 - CVE-2026-77365 published to NVD
- 2026-08-28 - Last updated in NVD database
Technical Details for CVE-2026-77365
Vulnerability Analysis
The Optimole plugin exposes REST API endpoints and profiling functions that accept the a parameter, used to define above-the-fold images for lazy-loading optimization. The plugin stores this attacker-controlled input and later renders it into responses and pages without adequate sanitization or output escaping. Because the value is persisted, injected payloads execute in the browsers of any user who subsequently loads the affected page.
The scope-changed nature of the flaw means script execution can affect users beyond the vulnerable component. Payloads executing in an authenticated administrator context can pivot to plugin configuration changes, user creation, and further site compromise. The vulnerability requires no authentication and no user interaction beyond visiting the affected page.
Root Cause
The issue resides in how the above_fold_images value is handled across inc/manager.php, inc/rest.php, and inc/v2/PageProfiler/Profile.php. Input received via REST endpoints is stored and later emitted without applying WordPress escaping functions such as esc_attr(), esc_html(), or wp_kses(). The absence of a sanitization callback in the REST route registration and missing output escaping on the storage-to-render path allows raw HTML and JavaScript to survive to the DOM.
Attack Vector
An unauthenticated attacker sends a crafted request to a plugin REST endpoint containing a JavaScript payload in the a parameter. The plugin stores the payload as part of the page profile data. When any user, including administrators, loads a page that renders the stored profile, the browser parses and executes the injected script. See the Wordfence Vulnerability Report and the Optimole WP Profile Changeset for technical references to the vulnerable code paths.
Detection Methods for CVE-2026-77365
Indicators of Compromise
- Requests to Optimole REST API routes containing <script>, onerror=, onload=, or encoded JavaScript in the a or above_fold_images parameter.
- Unexpected inline scripts, iframes, or event handlers rendered on pages that use Optimole page profiling.
- Newly created administrator accounts or modified user roles following anomalous requests to /wp-json/optimole/ endpoints.
- Outbound requests from visitor browsers to unknown domains after page loads.
Detection Strategies
- Review web server access logs for POST or PUT requests to Optimole REST endpoints from unauthenticated sources containing script markup.
- Inspect the WordPress options table and Optimole page profile data for HTML tags or JavaScript keywords in stored image identifiers.
- Deploy a web application firewall rule that flags script-like content in JSON bodies destined for /wp-json/optimole-* routes.
Monitoring Recommendations
- Monitor for changes to WordPress user accounts and plugin configuration following bursts of REST API traffic.
- Alert on Content Security Policy violation reports originating from pages served by sites running Optimole.
- Track plugin version inventory across WordPress fleets and generate alerts when optimole-wp versions at or below 4.2.10 are detected.
How to Mitigate CVE-2026-77365
Immediate Actions Required
- Update the Optimole plugin to version 4.2.11 or later on all WordPress sites.
- Audit stored page profile data and Optimole options for previously injected payloads and remove malicious entries.
- Rotate administrator credentials and invalidate active sessions if injection is confirmed.
- Review recent administrator activity, plugin installations, and user creations for signs of exploitation.
Patch Information
The vendor released the fix in Optimole version 4.2.11. The patch introduces sanitization and output escaping on the above_fold_images handling paths. See the Optimole WP Version Change Log for the diff between 4.2.10 and 4.2.11.
Workarounds
- Deactivate the Optimole plugin until the update to 4.2.11 can be applied.
- Deploy a WAF rule that blocks HTML tags and JavaScript event handlers in request bodies targeting Optimole REST routes.
- Enforce a strict Content Security Policy that disallows inline scripts to reduce impact of stored XSS.
# Update Optimole plugin using WP-CLI
wp plugin update optimole-wp --version=4.2.11
wp plugin list --name=optimole-wp --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
