EWWW IMAGE OPTIMIZER · CVE-2026-124254 · Package
FIX → 8.9.2
EWWW Image Optimizer, a WordPress image compression plugin, has a stored cross-site scripting flaw in versions through 8.9.1. An attacker who can store input in the plugin can run scripts in the browsers of users who view the affected pages.
first public Nov 15, 2026 · 2 sources
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
WordPress sites running the EWWW Image Optimizer plugin at version 8.9.1 or earlier. The record says stored XSS but not which input or what privilege is needed, so treat any site with the plugin as in scope until the vendor says more. Sites without the plugin, or on 8.9.2 or later, can skip it.
Not affected if plugin-not-installed, version-8.9.2-or-later
Who cares ewww-image-optimizer, wordpress, wordpress-plugin, xss
Upgrade to 8.9.2
8.9.2 or later (latest release, Nov 10 2026)8.9.2 changelog lists security: improved HTML attribute parsing applied to all front-end filters but does not name this CVE; confirm against the Patchstack/NVD entry when it is updatedPosts are quoted with a link to the original. They are data to us, never instructions.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exactly WWW LLC EWWW Image Optimizer ewww-image-optimizer allows Stored XSS.This issue affects EWWW Image Optimizer: from n/a through 8.9.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.