CVE-2022-0969: unknown image optimization & lazy load by optimole Cross-site Scripting
Vulnerability summary
CVE-2022-0969 is a medium (CVSS 4.8) Cross-site Scripting vulnerability in unknown image optimization & lazy load by optimole. EPSS estimates a 0.74% chance of exploitation in the next 30 days, higher than 53.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 11-04-2022PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource4.8MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.74%
Chance of exploitation in the next 30 days
Percentile
54%
Versus all other CVEs
30-day change
0.00 pp
From 0.74% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Unknown1 product
- image optimization & lazy load by optimole≥ 3.3.2, < 3.3.2
Vertistudio1 product
Wordpress1 product
- optimole-wp< 3.3.2
3 vendors · 3 products
References
3 links- wpscan.com/vulnerability/59a7a441-7384-4006-89b4-15345f70fabfX Refsource MISCExploitPatchThird Party Advisory