CVE-2026-5217
Published: 11 April 2026
Summary
CVE-2026-5217 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).
Deeper analysis
CVE-2026-5217 is a stored cross-site scripting (XSS) vulnerability (CWE-79) affecting the Optimole – Optimize Images plugin for WordPress in all versions up to and including 4.2.2. The issue stems from insufficient input sanitization and output escaping on the user-supplied 's' parameter, which represents a srcset descriptor, in the unauthenticated /wp-json/optimole/v1/optimizations REST endpoint. Although the endpoint validates requests using an HMAC signature and timestamp, these values are exposed directly in the frontend HTML, making them accessible to any site visitor. The plugin applies sanitize_text_field() to the descriptor in rest.php, which strips HTML tags but fails to escape double quotes, allowing malicious payloads to persist.
Unauthenticated attackers can exploit this vulnerability over the network with low complexity and no privileges or user interaction required (CVSSv3.1 score of 7.2: AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). By crafting a request with a poisoned srcset descriptor containing arbitrary JavaScript—leveraging the exposed HMAC and timestamp—they can store the payload via WordPress transients (backed by the options table). When retrieved, the descriptor is injected verbatim into the srcset attribute in tag_replacer.php without escaping, causing scripts to execute in users' browsers whenever the affected page loads.
The provided references link to specific vulnerable code locations in the plugin source, including lines 1008 and 159 in inc/rest.php (versions 4.2.1 and trunk) for input handling and line 526 in inc/tag_replacer.php (version 4.2.1) for output injection in the srcset attribute.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-21662
Vulnerability details
The Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 4.2.2. This is due to insufficient…
more
input sanitization and output escaping on the user-supplied 's' parameter (srcset descriptor) in the unauthenticated /wp-json/optimole/v1/optimizations REST endpoint. The endpoint validates requests using an HMAC signature and timestamp, but these values are exposed directly in the frontend HTML making them accessible to any visitor. The plugin uses sanitize_text_field() on the descriptor value of rest.php, which strips HTML tags but does not escape double quotes. The poisoned descriptor is then stored via transients (backed by the WordPress options table) and later retrieved and injected verbatim into the srcset attribute of tag_replacer.php without proper escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts into pages that will execute whenever a user accesses the injected page.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Stored XSS in public-facing WordPress plugin REST endpoint allows unauthenticated network exploitation of the application (T1190) and direct injection/execution of arbitrary JavaScript in victim browsers (T1059.007).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires validation of the user-supplied 's' parameter to prevent storage of malicious payloads due to insufficient sanitization with sanitize_text_field().
Mandates output filtering/escaping when injecting the stored descriptor into the srcset attribute in tag_replacer.php, preventing script execution in users' browsers.
Ensures timely identification, reporting, and correction of the flaw in the Optimole plugin's REST endpoint and tag replacer, eliminating the stored XSS vulnerability.