Executive Summary

The vulnerability exists in the Optimole WordPress plugin (versions up to 4.2.2) and is a Stored Cross-Site Scripting (XSS) issue. It arises because the plugin does not properly sanitize and escape user input on the 's' parameter (srcset descriptor) in the unauthenticated REST endpoint /wp-json/optimole/v1/optimizations.

Although the endpoint uses an HMAC signature and timestamp for validation, these values are exposed in the frontend HTML, making them accessible to any visitor. The plugin uses sanitize_text_field() which removes HTML tags but does not escape double quotes, allowing attackers to inject malicious scripts.

The malicious input is stored via transients in the WordPress options table and later injected directly into the srcset attribute without proper escaping, enabling arbitrary script execution whenever a user accesses the affected page.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows unauthenticated attackers to inject and store malicious scripts that execute in the browsers of users visiting the affected site.

• It can lead to theft of user credentials or session tokens.
• It may enable attackers to perform actions on behalf of users (such as changing settings or stealing data).
• It can damage the reputation of the affected website by exposing visitors to malicious content.

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves checking for the presence of malicious scripts injected via the 's' parameter in the /wp-json/optimole/v1/optimizations REST endpoint. Since the vulnerability allows stored cross-site scripting through the srcset descriptor, inspecting HTTP requests and responses for suspicious or unexpected script content in the srcset attribute can help identify exploitation attempts.

You can use network monitoring tools or command-line utilities to capture and analyze HTTP traffic to the vulnerable endpoint.

• Use curl or wget to fetch the REST endpoint and inspect the 's' parameter in the response, for example: curl -v https://yourwordpresssite.com/wp-json/optimole/v1/optimizations
• Use grep or similar tools to search for suspicious script tags or unusual content in the srcset attribute within the WordPress options table or transient storage in the database.
• Scan your WordPress database options table for entries containing script tags or suspicious payloads injected via the 's' parameter.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the Optimole plugin to a version later than 4.2.2 where this vulnerability is fixed.

If an update is not immediately possible, consider disabling the Optimole plugin temporarily to prevent exploitation.

Additionally, review and sanitize any stored data in the WordPress options table or transient storage that may contain malicious scripts injected via the vulnerable parameter.

Implement Web Application Firewall (WAF) rules to block suspicious requests targeting the /wp-json/optimole/v1/optimizations endpoint.

Useful 0 Not Useful 0