CVE-2026-91049
EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.
| Vendor | unknown |
| Product | ewww image optimizer |
| Published | Nov 5, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown ewww image optimizer
Be the first to know when new unknown vulnerabilities affecting unknown ewww image optimizer are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / EWWW Image Optimizer
8.7.4 < 8.9.1
References
Credits
Charles Vosburgh WPScan