CVE-2026-89193

HighCVSS 7.5

Published: 30/09/2026(UTC)Updated: 30/09/2026(UTC)Translated: 30/09/2026(UTC)NVD NIST

Summary

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled. This allows unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.

Risk Assessment

XSS attacks can lead to admin session hijacking, data theft, or content modification on the site.

Recommendation

Update the Robin Image Optimizer plugin to version 2.0.8 or later to prevent script injection.

Other vulnerabilities in Robin Image Optimizer

CVE-2026-89190Medium
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers. This allows users with a subscriber-level account to render admin-only plugin pages and disclose the plugin's stored settings.

Original NVD description (English source)

The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS