The Optimole WordPress plugin suffers from a stored XSS vulnerability due to improper neutralization of input in the 's' parameter of its REST API endpoint. Although the endpoint uses HMAC signatures and timestamps for validation, these values are exposed in frontend HTML, allowing unauthenticated attackers to craft malicious requests. The plugin uses sanitize_text_field() which removes HTML tags but does not escape double quotes, enabling injection of scripts into the srcset attribute of images. The malicious input is stored in transients and later rendered without proper escaping, leading to persistent XSS that executes in users' browsers.

An attacker can inject arbitrary JavaScript code into pages served by the vulnerable plugin, which will execute in the context of any user visiting those pages. This can lead to theft of user credentials, session hijacking, or other malicious actions limited to the scope of the affected site. The vulnerability requires no authentication and has a CVSS score of 7.2 (high severity). There are no known exploits in the wild at the time of this report.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the plugin or restricting access to the vulnerable REST endpoint if possible. Monitor vendor channels for updates and apply patches promptly once available.