CVE-2024-1047mediumCWE-862

CVE-2024-1047: medium-severity vulnerability in Optimole – Optimize Images in Real Time

ThemeIsle SDK <= Various Versions - Missing Authorization

Published · Updated

Follow this CVE+ Monitor RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator+ Monitor Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.3epss 0.6%
Multiple plugins and/or themes for WordPress with the ThemeIsle SDK are vulnerable to unauthorized modification of data due to a missing capability check on the register_reference() function in various versions. This makes it possible for unauthenticated attackers to update options values that allow ThemeIsle to track promotional activities via utm_source.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
optimole · Optimole – Optimize Images in Real Timeoptimole · Super Page Cachersocial · Revive Social – Social Media Auto Post and Scheduling Automation Pluginthemeisle · LightStart – Maintenance Mode, Coming Soon and Landing Page Builderthemeisle · Menu Icons by ThemeIslethemeisle · Multiple Page Generator Plugin – MPGthemeisle · Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & Morethemeisle · Otter Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSEthemeisle · PPOM – Product Addons & Custom Fields for WooCommercethemeisle · RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregatorthemeisle · Starter Sites & Templates by Nevethemeisle · Visualizer: Tables and Charts Manager for WordPress
Related CVEs — Optimole – Optimize Images in Real Time

In the same product, most dangerous first.

CVE-2026-5226MEDIUMOptimole <= 4.2.3 - Reflected Cross-Site Scripting via Page Profiler URLEPSS 0.5%CVE-2026-5217HIGHOptimole <= 4.2.2 - Unauthenticated Stored Cross-Site Scripting via Srcset Descriptor ParameterEPSS 0.5%CVE-2024-4636MEDIUMImage Optimization by Optimole – Lazy Load, CDN, Convert WebP & AVIF <= 3.12.10 - Authenticated (Author+) Stored Cross-Site Scripting via SVG UploadEPSS 0.4%CVE-2025-11519MEDIUMImage optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media OffloadEPSS 0.3%CVE-2026-1843HIGHSuper Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity LogEPSS 0.2%