CVE-2026-120677
validatedZero produced an exploit or a check.description
Optimole for WordPress through version 4.2.18 is affected by stored cross-site scripting in comment handling. An unauthenticated attacker may cause script execution when a user visits an affected post, if an administrator approves the submitted comment and the post contains an iframe or video element.
mitigation
Update to a vendor release later than 4.2.18 when one is available. Until then, restrict or moderate comment approvals and disable video lazy loading or avoid iframe and video elements on posts that accept comments.
outcome
Upstream: a detection for this already ships elsewhere, so we didn't generate a new one. The credit goes to whoever did.
source signals
Public signals that triggered or updated the pipeline. These are inputs for the deltas above.
- 2026-11-07 03:28Zcve_org: trigger signal, started the run
- 2026-11-07 04:04Z
this entry in the feed
GET /api/v1/feed/CVE-2026-120677
{ "etk_id": "ETK-2026-3789", "cve_id": "CVE-2026-120677", "display_id": "CVE-2026-120677", "ghsa_id": null, "euvd_id": "EUVD-2026-118603", "status": "published", "anchor_state": "anchored", "title": "Stored cross-site scripting in Optimole for WordPress", "summary": "Optimole for WordPress through version 4.2.18 is affected by stored cross-site scripting in comment handling. An unauthenticated attacker may cause script execution when a user visits an affected post, if an administrator approves the submitted comment and the post contains an iframe or video element.", "mitigation": "Update to a vendor release later than 4.2.18 when one is available. Until then, restrict or moderate comment approvals and disable video lazy loading or avoid iframe and video elements on posts that accept comments.", "vendor": "optimole", "product": "Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization", "affected": [ { "affected_notes": [], "affected_ranges": [ ">= 0, <= 4.2.18" ], "ecosystem": null, "fixed_versions": [], "package_name": "Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization", "purl": null } ], "cwes": [ 79 ], "cvss_score": 7.2, "cvss_src": "cna_vendor", "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N", "epss_score": null, "epss_percentile": null, "epss_asof": null, "automation": "deterministic", "check": true, "check_confidence_basis": "upstream", "exploit": false, "pipeline_minutes": 0.2148151, "t0_at": "2026-11-07T03:28:06.596000+00:00", "signals": { "check": { "at": "2026-11-07T04:04:42.000049+00:00", "days": 0.025409769085648147, "is_lower_bound": false, "measured_at": "2026-11-07T03:28:06.596000+00:00", "url": null }, "trigger_signal": { "at": "2026-11-07T03:28:06.596000+00:00", "days": 0, "is_lower_bound": false, "measured_at": "2026-11-07T03:28:06.596000+00:00", "url": "https://www.cve.org/CVERecord?id=CVE-2026-120677" } } }
published 2026-11-07 04:04Z
last change 2026-11-07 05:51Z
Need the technical details behind an entry?
Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.