CVE-2026-15446
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The EWWW Image Optimizer plugin for WordPress up to version 8.7.3 is vulnerable to Stored Cross-Site Scripting via the 'data-script' attribute in post content due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page.
Risk Assessment
The risk includes malicious script execution in users' browsers, which can lead to data theft, session hijacking, or further attacks.
Recommendation
Update the EWWW Image Optimizer plugin to the latest version that includes the fix. Restrict user permissions to contributor level only for trusted individuals.
Other vulnerabilities in EWWW Image Optimizer
See all- CVE-2026-97067Medium
Cross Site Scripting (XSS) vulnerability in EWWW Image Optimizer up to version 8.7.7. A contributor can inject malicious scripts.
- CVE-2026-91051Medium
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered. This allows PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present.
- CVE-2026-92826Medium
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in versions up to and including 8.7.7 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject scripts that execute if they can trick a user into clicking a link. Successful exploitation requires the enable_help option to be active.
- CVE-2026-91011Medium
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output. This allows authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of any user who later views the affected page.
- CVE-2026-84773High
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer versions up to 8.7.6. An attacker can inject malicious script without authentication.
Original NVD description (English source)
The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is achieved by embedding a crafted img element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in post content, which the plugin's bundled lazysizes ls.unveilhooks addon then uses to dynamically create and insert a script element into the DOM at page view time.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS