CVE-2026-92826: EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUESTURI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the enablehelp option is active, as the vulnerable HelpScout Beacon script block is only emitted when that setting is enabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the enable_help option to prevent the vulnerable HelpScout Beacon script block from being emitted.
EWWW Image Optimizer enable_help = false
Event History
Frequently Asked Questions
Who is exposed to this issue?
WordPress sites using EWWW Image Optimizer version 8.7.7 or earlier are exposed only when the enable_help option is active. Exploitation targets users who can be persuaded to follow a crafted link or perform a similar action.
Does an attacker need an account or elevated privileges?
No. The issue can be exploited by an unauthenticated attacker, but successful exploitation requires user interaction.
What configuration should be checked during triage?
Check whether the EWWW Image Optimizer enable_help option is enabled. The vulnerable HelpScout Beacon script block is emitted only when that setting is active.
How can the risk be reduced if an update cannot be applied immediately?
Disable the enable_help option to prevent the vulnerable HelpScout Beacon script block from being emitted. This mitigation is supported by the stated exploitation condition.