OCTOBER 14, 2026
Live Feed
Back to database
Case File

CVE-2026-84829

HIGH · CVSS 8.8 EPSS 0.51%

Source: NVD + CISA KEV + EPSS · Published 2026-09-16 · Last synced 2026-10-13

CyberRota Analysis

AI-Generated

The Optimole WordPress plugin prior to version 4.2.12 is vulnerable to Stored Cross-Site Scripting due to improper escaping of user-supplied values in image tag attributes. This flaw allows unauthenticated users to inject arbitrary attributes, potentially compromising the integrity of web pages for all visitors. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate this security risk.

CVE
CVE-2026-84829
Severity
HIGH
CVSS
8.8
EPSS
0.51%
WordPress

Original NVD Description

The Optimole WordPress plugin before 4.2.12 does not properly escape a user supplied value before using it to build an image tag attribute, allowing unauthenticated users to inject arbitrary attributes into pages served to every visitor, which leads to Stored Cross-Site Scripting.