CVE-2026-84773
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer versions up to 8.7.6. An attacker can inject malicious script without authentication.
Risk Assessment
Potential for user session theft, admin account takeover, or spreading malicious code on the site.
Recommendation
Update the EWWW Image Optimizer plugin to the latest version that includes the fix.
Other vulnerabilities in EWWW Image Optimizer
See all- CVE-2026-91011Unknown
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output. This allows authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of any user who later views the affected page.
- CVE-2026-15446Medium
The EWWW Image Optimizer plugin for WordPress up to version 8.7.3 is vulnerable to Stored Cross-Site Scripting via the 'data-script' attribute in post content due to insufficient input sanitization and output escaping. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts that execute when a user accesses an injected page.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.