CVE-2026-77365

CVE-2026-77365 is a stored cross-site scripting (XSS) flaw in the Optimole image-optimization plugin for WordPress, caused by insufficient input sanitization and output escaping of the 'a' (above_fold_images) parameter in all versions up to and including 4.2.10. An unauthenticated attacker can supply a crafted value for this parameter so that arbitrary web scripts are stored and embedded in pages of the affected site. The injected JavaScript then executes whenever a user accesses the injected page, potentially enabling session hijacking, redirects, or actions taken in the context of logged-in users. Any WordPress site running Optimole 4.2.10 or earlier is affected. Exploitation has not been confirmed: no public proof of concept is known, the issue is not in CISA KEV, and EPSS assigns only a 0.3% probability of exploitation within 30 days.

What to do: Update Optimole to the latest available release (any version after 4.2.10; no specific fixed version number is provided in the available data). Until patched, consider deactivating the plugin or deploying WAF rules that restrict unexpected values in the 'a'/above_fold_images parameter. Review rendered pages for already-injected scripts and check access logs for suspicious unauthenticated requests that reference this parameter.