Log in Start free

Optimole

Products

ProductCVEsExploitedLatest
Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization5–Nov 7, 2026
Optimole – Optimize Images in Real Time5–Apr 11, 2026
Optimole2–Sep 30, 2026
Super Page Cache2–Feb 14, 2026
Super Page Cache for Cloudflare1–Mar 21, 2024

Exploited and recent CVEs

  • CVE-2026-120677 High 7.2 Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment Content –
  • CVE-2026-120739 High 7.2 Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor –
  • CVE-2026-119070 High 7.2 Optimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer –
  • CVE-2026-102375 Medium 6.5 WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability 0.3%
  • CVE-2026-77365 High 7.2 Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter 0.5%
  • CVE-2026-57673 High 7.1 WordPress Optimole plugin <= 4.2.7 - Cross Site Scripting (XSS) vulnerability 0.3%
  • CVE-2026-11784 Medium 4.3 Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action 0.2%
  • CVE-2026-5217 High 7.2 Optimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor Parameter 0.4%
  • CVE-2026-5226 Medium 6.1 Optimole <= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URL 0.5%
  • CVE-2026-1843 High 7.2 Super Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity Log 0.2%
  • CVE-2025-11519 Medium 4.3 Image optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload 0.3%
  • CVE-2024-4636 Medium 6.4 Image Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG Upload 0.4%
  • CVE-2024-27968 High 7.1 WordPress Super Page Cache for Cloudflare plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) to XSS vulnerability 0.2%
  • CVE-2024-1047 Medium 5.3 ThemeIsle SDK <= Various Versions - Missing Authorization 0.6%
  • CVE-2024-1047 Medium 5.3 ThemeIsle SDK <= Various Versions - Missing Authorization 0.6%