CVE-2026-5217: 
WordPress vulnerability analysis and mitigation

CVE-2026-5217 is a Stored Cross-Site Scripting (XSS) vulnerability in the Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress, affecting all versions up to and including 4.2.2. The flaw resides in the unauthenticated /wp-json/optimole/v1/optimizations REST endpoint, where insufficient sanitization of the s parameter (srcset descriptor) allows arbitrary JavaScript injection into stored page content. It was published on April 11, 2026, with a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), stemming from two compounding flaws: the plugin applies sanitize_text_field() in rest.php to the s parameter, which strips HTML tags but does not escape double quotes, and the sanitized value is later injected verbatim into the srcset attribute in tag_replacer.php without output escaping (GitHub Advisory). Although the REST endpoint validates requests via an HMAC signature and timestamp, these values are exposed directly in the frontend HTML and are therefore accessible to any unauthenticated site visitor. The poisoned descriptor is persisted via WordPress transients (backed by the options table), meaning the malicious payload is stored server-side and served to all subsequent visitors of the affected page (GitHub Advisory). Relevant vulnerable code locations include rest.php#L159, rest.php#L1008, and tag_replacer.php#L526 in plugin version 4.2.1.

Successful exploitation allows unauthenticated attackers to persistently inject arbitrary JavaScript into WordPress pages, which executes in the browsers of any user who visits the affected page. Potential consequences include session hijacking, credential theft, malware distribution, site defacement, and unauthorized actions performed on behalf of compromised users — including administrators. Because no user interaction is required from the attacker and the scope is changed (affecting users beyond the vulnerable component), the blast radius extends to all visitors of the compromised site (GitHub Advisory, Feedly).

As of the time of reporting, no public proof-of-concept exploit code has been identified and there is no evidence of active in-the-wild exploitation (Feedly). The EPSS score is approximately 0.045% (0.000780), placing it in the 14th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the Optimole plugin version ≤ 4.2.2 by checking publicly accessible plugin metadata (e.g., /wp-content/plugins/optimole-wp/readme.txt) or using web scanning tools.
2. Extract HMAC credentials: Visit any page on the target site that uses Optimole-optimized images and inspect the frontend HTML source to retrieve the exposed HMAC signature and timestamp values embedded by the plugin.
3. Craft malicious request: Construct an HTTP POST request to /wp-json/optimole/v1/optimizations including the extracted HMAC signature and timestamp for authentication, and set the s parameter (srcset descriptor) to a payload that breaks out of the srcset attribute context using double quotes, e.g., 1x" onload="alert(document.cookie) or a more sophisticated JavaScript payload.
4. Store the payload: Submit the crafted request; the plugin processes the s value through sanitize_text_field() (which does not escape double quotes), then stores the poisoned descriptor via WordPress transients in the options table.
5. Trigger execution: Any user (including administrators) who visits a page where Optimole renders an image with the poisoned srcset descriptor will have the injected JavaScript execute in their browser, enabling session hijacking, credential theft, or further exploitation (GitHub Advisory).

• Network: Unusual POST requests to /wp-json/optimole/v1/optimizations containing double-quote characters or JavaScript event handlers (e.g., onload=, onerror=) in the s parameter; outbound connections from the web server to unknown external hosts following page loads.
• Logs: Web server access logs showing POST requests to the Optimole REST endpoint with encoded or suspicious s parameter values; repeated requests from the same IP probing the endpoint.
• Database / File System: WordPress options table entries (transients) created or modified by the Optimole plugin containing JavaScript snippets or HTML attribute injection strings (e.g., values with ", onload, onerror, <script>).
• Browser / User Reports: Users reporting unexpected pop-ups, redirects, or browser alerts when visiting pages with Optimole-processed images; administrator sessions being hijacked or unexpected admin actions occurring.

The primary remediation is to update the Optimole plugin to a version beyond 4.2.2, which contains the patch addressing the insufficient output escaping (GitHub Advisory). As interim measures, administrators should review the WordPress options table for suspicious transient entries created by the Optimole plugin, implement Content Security Policy (CSP) headers to restrict unauthorized script execution, and monitor REST API access logs for anomalous requests to /wp-json/optimole/v1/optimizations. If the plugin is not actively in use, disabling it or blocking access to the REST endpoint via a Web Application Firewall (WAF) can reduce exposure (Feedly).

Wordfence included CVE-2026-5217 in its weekly WordPress vulnerability report for April 6–12, 2026, and Sucuri referenced it in its April 2026 vulnerability patch roundup (Wordfence, Sucuri). The vulnerability was also picked up by security aggregators including RedPacket Security and INCIBE-CERT, indicating moderate community awareness. No notable individual researcher commentary or significant social media discussion has been identified beyond standard vulnerability tracking coverage.