Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization — Vulnerabilities & Security Advisories 6

All 6 CVE vulnerabilities found in Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization, with AI-generated Chinese analysis, references, and POCs.

Vendor: optimole

CVE ID	Title	CVSS	Severity	Published
CVE-2026-124969	Optimole <= 4.2.19 - Unauthenticated PHP Object Injection to Arbitrary File Deletion via 'comment_content'/'comment_agent' Parameter during Attachment Rename CWE-502	7.1	High	2026-11-14
CVE-2026-120677	Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Comment Content CWE-79	7.2	High	2026-11-07
CVE-2026-120739	Optimole <= 4.2.18 - Unauthenticated Stored Cross-Site Scripting via Page Profiler srcset Descriptor CWE-79	7.2	High	2026-11-07
CVE-2026-119070	Optimole <= 4.2.17 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Backslash-Escaped Unicode in URL Replacer CWE-79	7.2	High	2026-11-07
CVE-2026-77365	Optimole <= 4.2.10 - Unauthenticated Stored Cross-Site Scripting via 'a' (above_fold_images) Parameter CWE-79	7.2	High	2026-08-28
CVE-2026-11784	Optimole – Optimize Images \| Convert WebP & AVIF \| CDN & Lazy Load \| Image Optimization <= 4.2.6 - Cross-Site Request Forgery via 'optml_replace_file' AJAX Action CWE-352	4.3	Medium	2026-06-18

All 6 known CVE vulnerabilities affecting Optimole – Optimize Images | Convert WebP & AVIF | CDN & Lazy Load | Image Optimization with full Chinese analysis, references, and POCs where available.