Stored cross-site scripting in EWWW Image Optimizer plugin
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
The EWWW Image Optimizer WordPress plugin from 8.7.4 before 8.9.1 does not sanitize a value in post content before using it to dynamically load and execute a script (CWE-79). An authenticated attacker with author-level access or higher can inject web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of an earlier flaw, and the references link to an exploit.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | EWWW Image Optimizer | 8.7.4 to before 8.9.1 | 8.9.1 | Patch available | CNA |
- EWWW Image Optimizer VendorUnknown Affected 8.7.4 to before 8.9.1 Fixed in 8.9.1 Patch available CNA
Remediation
Update EWWW Image Optimizer to version 8.9.1, which fixes the flaw. The sources list no other fixed version for EWWW Image Optimizer.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA EWWW Image Optimizer (Unknown) Fixed in 8.9.1
Timeline
- 2026-11-05 Threatist record created from CVE-2026-91049
- 2026-11-05 Alias added: GHSA-3ccr-99wp-7ppp
- 2026-11-06 CVSS score added · CISA ADP
- 2026-11-06 Weakness changed · CISA ADP
- 2026-11-06 CISA SSVC decision points changed
References
Sources
- CVE-2026-91049 · CVE Program
- CVE-2026-91049 · NVD
- FIRST EPSS
- GHSA-3ccr-99wp-7ppp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences