CVE-2026-89193: Robin Image Optimizer 2.0.0 - 2.0.7 - Unauthenticated Stored XSS via WebP URL Delivery HTML Parser
The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Robin Image Optimizerto a version that resolves this vulnerability.Fixed in 2.0.8
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Robin Image Optimizer versions 2.0.0 through 2.0.7 are affected when a non-default image delivery mode is enabled. The issue is not described as affecting the default delivery mode.
What does an attacker need to exploit it?
An attacker can submit crafted content without authentication. The malicious content must be stored and later viewed in a browser for the XSS payload to execute.
Who can be impacted when the payload executes?
Any user who views an affected page can be exposed, including WordPress administrators. Administrative users are specifically at risk if they browse to a page containing stored attacker-controlled content.
What version addresses the vulnerability?
The issue affects plugin versions before 2.0.8. Updating to version 2.0.8 or later addresses the affected version range described.