Optimole <= 4.2.2 - 通过 Srcset Descriptor 参数实现的未认证存储型跨站脚本漏洞

攻击者可以利用此XSS漏洞在受感染的WordPress网站上执行任意JavaScript代码。这可能导致攻击者窃取用户会话cookie，从而冒充用户执行操作，例如更改用户配置文件、发布恶意内容或重定向用户到恶意网站。由于HMAC签名和时间戳暴露在前端HTML中，攻击者可以轻松绕过身份验证机制。此漏洞的潜在影响包括数据泄露、网站劫持和用户欺骗。

Websites utilizing the Optimole plugin, particularly those running older versions (0.0.0–4.2.2), are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a compromise of one site could potentially lead to the compromise of others. Sites with less stringent security practices or those that haven't implemented regular security updates are particularly vulnerable.

• wordpress / composer / npm:

grep -r 'srcset descriptor' /var/www/html/wp-content/plugins/optimole/includes/rest-api/

• wordpress / composer / npm:

wp plugin list --status=active | grep optimole

• wordpress / composer / npm:

curl -I 'https://your-wordpress-site.com/wp-json/optimole/v1/optimizations?s=alert("XSS")'

• generic web: Inspect the HTML source code of pages using the Optimole plugin for suspicious JavaScript code injected via the 's' parameter in the /wp-json/optimole/v1/optimizations endpoint.

1. 2026-04-11Disclosure

   disclosure

1. 已保留2026-03-31
2. 发布日期2026-04-11
3. 修改日期2026-04-13
4. EPSS 更新日期2026-04-18

最有效的缓解措施是立即将Optimole WordPress插件升级至4.2.3或更高版本。如果无法立即升级，可以考虑禁用Optimole插件，或者限制对/wp-json/optimole/v1/optimizations REST端点的访问。使用Web应用防火墙（WAF）可以帮助过滤恶意请求，但不能完全替代升级。监控WordPress网站的访问日志，查找可疑的JavaScript代码注入尝试。