The Optimole WordPress plugin versions up to 4.2.3 contain a reflected XSS vulnerability due to improper neutralization of input in URL paths. Specifically, the get_current_url() function fails to properly escape user input before inserting it into JavaScript code via str_replace() in the replace_content() function. This flaw enables unauthenticated attackers to craft malicious URLs that, when visited by users, execute arbitrary JavaScript in the context of the affected site. The vulnerability is identified as CWE-79 and has a CVSS 3.1 base score of 6.1 (medium severity). No patch or official fix has been documented, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of the affected website via reflected XSS. This can lead to limited confidentiality and integrity impacts such as theft of user session data or manipulation of page content. There is no direct impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the plugin or employing web application firewall (WAF) rules to block suspicious URL patterns that may exploit this reflected XSS vulnerability. Avoid clicking on untrusted links that may trigger the vulnerability.