CVE-2026-92826

Deferred Deferred - Pending Action

BaseFortify

Publication date: 2026-10-03

Last updated on: 2026-10-06

Assigner: Wordfence

Description

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the enable_help option is active, as the vulnerable HelpScout Beacon script block is only emitted when that setting is enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-03

Last Modified

2026-10-06

Generated

2026-10-19

AI Q&A

2026-10-03

EPSS Evaluated

2026-10-18

NVD

CVE-2026-92826

EUVD

EUVD-2026-91894

Affected Vendors & Products

Vendor	Product	Version / Range
nosilver4u	EWWW	Image Optimizer 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This is a Reflected Cross-Site Scripting (XSS) vulnerability in the EWWW Image Optimizer WordPress plugin up to version 8.7.7. It occurs due to insufficient input sanitization and output escaping in the REQUEST_URI parameter. Attackers can inject malicious scripts into web pages if they trick users into clicking a link. Exploitation requires the enable_help option to be active.

Detection Guidance

This vulnerability can be detected by checking if the EWWW Image Optimizer plugin is installed and if the version is up to 8.7.7. Inspect the plugin settings for the enable_help option. Look for unusual scripts or links in pages served by WordPress that may indicate injected web scripts.

Impact Analysis

An attacker could steal user sessions, perform actions on behalf of users, or deface websites. Users might unknowingly execute malicious scripts when visiting a compromised page, leading to data theft or unauthorized access.

Compliance Impact

This vulnerability could lead to unauthorized data access or disclosure, violating GDPR's data protection principles or HIPAA's security requirements. Organizations may face compliance penalties if user data is compromised due to this flaw.

Mitigation Strategies

Immediately update the EWWW Image Optimizer plugin to the latest version beyond 8.7.7. Disable the enable_help option if it is enabled. Review WordPress pages for unexpected scripts and remove any suspicious content. Consider temporarily disabling the plugin until updated if exploitation is suspected.

Hi! I’m here to help you understand CVE-2026-92826. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70