CVE-2026-91049
Received Received - Intake

Stored Cross-Site Scripting in EWWW Image Optimizer WordPress Plugin

Publication date: 2026-11-05

Last updated on: 2026-11-05

Assigner: WPScan

Description
The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-05
Last Modified
2026-11-05
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-91049
EUVD
EUVD-2026-117348

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown EWWW Image Optimizer 8.7.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a stored cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer WordPress plugin versions 8.7.4 through 8.9.0. It allows authenticated attackers with author-level access or higher to inject malicious scripts into posts via the 'data-script' lazy load attribute. The scripts execute when other users, including administrators, view the affected page.

Detection Guidance

Check for vulnerable EWWW Image Optimizer plugin versions 8.7.4 through 8.9.0. Inspect WordPress posts for injected scripts using the 'data-script' lazy load attribute. Review server logs for unusual script execution patterns in user-generated content.

Impact Analysis

An attacker could steal session cookies, perform actions on behalf of users, or redirect users to malicious sites. Administrators viewing a compromised page could have their accounts compromised, leading to full site takeover.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties if user data is compromised through this flaw.

Mitigation Strategies

Update the EWWW Image Optimizer plugin to version 8.9.1 or later immediately. Remove any suspicious scripts from posts and pages. Restrict author-level access to only trusted users until the update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-91049. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...