CVE-2026-96531 — Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block

CVE-2026-96531

Optimole 4.0.0 - 4.2.12 - Author+ Stored XSS via Video Player Block PUBLISHED

Description (CNA)

The Optimole WordPress plugin before 4.2.13 does not escape unrecognized attributes of its video-player block before rendering them onto the block's wrapper element, allowing users with the Author role and above to store an event-handler attribute that executes scripts in the browser of any user, such as an administrator, who views the post.

Affected (CNA)

Vendor / product	Versions
Unknown / Optimole	affected 4.0.0 before 4.2.13

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/15ad5748-8c2b-4c60-9818-57790f7033c7/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.