medium6.8
CVE-2026-96531
The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper el…
Impact
The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.
Affected products
| Product | Affected versions |
|---|---|
| Optimole WordPress Plugin | before 4.2.13 |
Versions were read from the advisory text. No structured product data has been published for this record yet.