CVE-2026-96531
Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block
Unknown Optimole
CVSS
6.8MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.24%Chance of exploitation activity in the next 30 days, higher than 13% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.2.13OptimoleCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.
Text from CVE List
Affected versions 1
- Optimoleaffected: 4.0.0 before 4.2.13CVE List