6.8
Moyenne
CVE-2026-91011 The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it…
Description
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of any user who later views the affected page.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| EWWW Image Optimizer 8.7 | premières → < 8.7.7 | 8.7.7 |
Autres CVE de EWWW Image Optimizer
Les 4 CVE de EWWW Image Optimizer →
CVE-2026-91049
EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute
6.4
Moyenne
CVE-2026-91072
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to…
4.4
Moyenne
CVE-2026-91051
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level…
6.6
Moyenne