Unknown Optimole vulnerabilities

3 CVEs affecting Unknown Optimole, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96530, published 2026-10-07.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-84829, published 2026-09-16. High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days. The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary…
CVE-2026-96531, published 2026-09-26. Medium severity, CVSS 6.8. EPSS: 0.2% chance of exploitation in the next 30 days. The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author…
CVE-2026-96530, published 2026-10-07. Medium severity, CVSS 6.5. EPSS: 0.2% chance of exploitation in the next 30 days. The Optimole WordPress plugin before 4.2.15 does not perform a capability check before exposing its stored image-optimization account data in a dashboard widget, allowing any authenticated user,…