Threats tagged 'ghsa-m3mp-7pq7-5q6h'

The Optimole WordPress plugin up to version 4.2.17 is vulnerable to stored cross-site scripting (XSS) via the 'comment' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary scripts that execute when users access affected pages. Exploitation requires the plugin to be connected with configured CDN keys and the image replacer enabled, which is the default setup. The injected payload bypasses WordPress comment sanitization by using a decoding mechanism unique to Optimole at render time.