{"id":"CVE-2026-91049","aliases":["EUVD-2026-117348","GHSA-3ccr-99wp-7ppp"],"status":"published","title":"EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute","description":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","severity":{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00208,"percentile":0.10974,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-11-05T06:00:27Z","modified":"2026-11-06T12:02:36Z","products":[{"vendor":"exactly www","product":"ewww image optimizer"},{"vendor":"unknown","product":"ewww image optimizer"}],"references":[{"url":"https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91049"},{"url":"https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7"},{"url":"https://github.com/advisories/GHSA-3ccr-99wp-7ppp"}],"sources":{"cve":[{"id":"CVE-2026-91049","title":"EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute","description":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","status":"published","published":"2026-11-05T06:00:27.687Z","modified":"2026-11-06T12:02:36.318Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T13:28:12.24582Z"}],"euvd":[{"id":"EUVD-2026-117348","description":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","status":"published","published":"2026-11-05T06:00:27Z","modified":"2026-11-06T12:02:36Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-06T13:04:55.758116Z"}],"ghsa":[{"id":"GHSA-3ccr-99wp-7ppp","title":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a...","description":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","status":"published","published":"2026-11-05T06:34:38Z","modified":"2026-11-06T15:32:31Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T16:00:41.773289Z"}],"nvd":[{"id":"CVE-2026-91049","description":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","status":"published","published":"2026-11-05T06:17:10.317Z","modified":"2026-11-06T13:17:33.167Z","cvss":[{"version":"3.1","score":6.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-06T16:00:36.254659Z"}]}}