The Robin Image Optimizer WordPress plugin suffers from a stored XSS vulnerability (CWE-79) in the 'Alternative Text' field of images in the Media Library. This occurs because the plugin does not properly sanitize or escape user input before rendering it on web pages. Attackers with Author-level privileges or higher can inject arbitrary JavaScript code that executes in the context of other users viewing the compromised pages. The vulnerability affects all versions up to 2.0.2 and has a CVSS 3.1 base score of 6.4 (medium severity). No patch or official fix details are currently available, and no exploits have been observed in the wild.

Successful exploitation allows an authenticated user with Author-level access or above to inject persistent malicious scripts into pages via the 'Alternative Text' field. This can lead to the execution of arbitrary JavaScript in the browsers of users who view the affected pages, potentially resulting in session hijacking, unauthorized actions, or other client-side impacts. The vulnerability does not impact availability and requires authenticated access with limited privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Author-level access to trusted users only and consider removing or sanitizing the 'Alternative Text' fields in the Media Library. Monitor vendor channels for updates or patches addressing this vulnerability.