CVE-2026-96531: CWE-79 Cross-Site Scripting (XSS) in Optimole
CVE-2026-96531 is a cross-site scripting (XSS) vulnerability in the Optimole WordPress plugin versions 4.0.0 up to but not including 4.2.13. It allows users with the Author role or higher to inject event-handler attributes into the video-player block wrapper element, which execute scripts in the browsers of users who view the affected post, including administrators.
AI Analysis
Technical Summary
The Optimole WordPress plugin before version 4.2.13 fails to properly escape unrecognized attributes in its video-player block before rendering them. This flaw permits users with Author role or above to store event-handler attributes that execute arbitrary scripts in the browsers of users viewing the post, leading to a stored cross-site scripting vulnerability.
Potential Impact
An attacker with Author-level permissions can inject malicious scripts that execute in the context of users who view the post, potentially including administrators. This can lead to session hijacking, privilege escalation, or other malicious actions within the WordPress environment.
Mitigation Recommendations
Upgrade the Optimole plugin to version 4.2.13 or later, where this vulnerability is fixed. No other mitigation is indicated or required.
CVE-2026-96531: CWE-79 Cross-Site Scripting (XSS) in Optimole
Description
CVE-2026-96531 is a cross-site scripting (XSS) vulnerability in the Optimole WordPress plugin versions 4.0.0 up to but not including 4.2.13. It allows users with the Author role or higher to inject event-handler attributes into the video-player block wrapper element, which execute scripts in the browsers of users who view the affected post, including administrators.
Affected software
Optimole
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Optimole WordPress plugin before version 4.2.13 fails to properly escape unrecognized attributes in its video-player block before rendering them. This flaw permits users with Author role or above to store event-handler attributes that execute arbitrary scripts in the browsers of users viewing the post, leading to a stored cross-site scripting vulnerability.
Potential Impact
An attacker with Author-level permissions can inject malicious scripts that execute in the context of users who view the post, potentially including administrators. This can lead to session hijacking, privilege escalation, or other malicious actions within the WordPress environment.
Mitigation Recommendations
Upgrade the Optimole plugin to version 4.2.13 or later, where this vulnerability is fixed. No other mitigation is indicated or required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-09-23T11:22:24.455Z
- State
- PUBLISHED
Threat ID: 6ab7672ef7a7c54106f7c89a
Added to database: 09/26/2026, 06:33:18 UTC
Last enriched: 09/26/2026, 06:47:45 UTC
Last updated: 09/26/2026, 06:56:17 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.