6.8
Medium
CVE-2026-91011 The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it…
Description
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of any user who later views the affected page.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| EWWW Image Optimizer 8.7 | earliest → < 8.7.7 | 8.7.7 |
Other CVEs of EWWW Image Optimizer
The 4 CVEs of EWWW Image Optimizer →
CVE-2026-91049
EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute
6.4
Medium
CVE-2026-91072
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to…
4.4
Medium
CVE-2026-91051
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level…
6.6
Medium