CVE-2026-77365: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in optimole Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization

CVE-2026-77365 is a stored cross-site scripting vulnerability in the Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization WordPress plugin. The flaw exists in the handling of the 'a' (above_fold_images) parameter, where input is not properly sanitized or escaped before being included in web pages. This enables unauthenticated attackers to inject arbitrary scripts that execute in the context of users visiting the affected pages. The vulnerability affects all versions up to and including 4.2.10.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browsers of users who visit the injected pages. This can lead to theft of user credentials, session hijacking, or other malicious actions performed in the context of the victim's browser. The vulnerability impacts confidentiality and integrity but does not affect availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, users should consider disabling or removing the plugin or restricting access to affected parameters if possible. Monitor the vendor's official channels for updates and apply any official fixes once released.