CVE-2026-91049: EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute

Published Nov 5, 2026

Updated

The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.

This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade EWWW Image Optimizer to a version that resolves this vulnerability.
Fixed in 8.9.1

Event History

Nov 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·06:17 AM

Description

Frequently Asked Questions

Which installations are affected?

EWWW Image Optimizer versions 8.7.4 through 8.9.0 are affected. The issue was fixed in version 8.9.1.

What access does an attacker need to exploit this issue?

An attacker must be authenticated to WordPress with Author-level access or higher and be able to place the crafted value into post content.

Who can be impacted by a malicious post?

Any user who views an affected page can have arbitrary scripts execute in their browser session. This includes WordPress administrators.

How can I tell whether content may already be malicious?

Review post content created or editable by Author-level and higher users for lazy-load attributes using the data-script value. The vulnerable behavior dynamically loads and executes the supplied script.

What should be done if the plugin cannot be updated immediately?

Restrict or suspend Author-level and higher users who are not fully trusted, and review their post content for suspicious data-script lazy-load attributes. This reduces the opportunity to inject scripts until version 8.9.1 can be deployed.

CVE-2026-91049: EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute

Remediation

Event History

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?

Who can be impacted by a malicious post?

How can I tell whether content may already be malicious?

What should be done if the plugin cannot be updated immediately?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What access does an attacker need to exploit this issue?

Who can be impacted by a malicious post?

How can I tell whether content may already be malicious?

What should be done if the plugin cannot be updated immediately?