{"id":"CVE-2026-124254","kind":"vulnerability","aliases":["CVE-2026-124254"],"related":[],"title":"EWWW Image Optimizer: stored XSS through 8.9.1 lets attackers inject scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exactly WWW LLC EWWW Image Optimizer ewww-image-optimizer allows Stored XSS.This issue affects EWWW Image Optimizer: from n/a through 8.9.1.","summary":"EWWW Image Optimizer, a WordPress image compression plugin, has a stored cross-site scripting flaw in versions through 8.9.1. An attacker who can store input in the plugin can run scripts in the browsers of users who view the affected pages.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"EWWW Image Optimizer","fixed":["8.9.2"],"affected":"<= 8.9.1","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["ewww-image-optimizer","package","wordpress","wordpress-plugin","xss"],"not_affected_if":["plugin-not-installed","version-8.9.2-or-later"],"how_to_check":"- Run wp plugin get ewww-image-optimizer --field=version, or read the Version header in wp-content/plugins/ewww-image-optimizer/ewww-image-optimizer.php, or see Plugins in wp-admin.\n- Exposed if the version is 8.9.1 or earlier; 8.9.2 or later is the release that follows the affected range.\n- Input vector and required privilege are not stated in the sources.","fix":"Update EWWW Image Optimizer to 8.9.2 or later (latest release, Nov 10 2026). The 8.9.2 changelog lists 'security: improved HTML attribute parsing applied to all front-end filters' but does not name this CVE; confirm against the Patchstack/NVD entry when it is updated.","status":"open","published_at":"2026-11-15T14:17:21+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","triaged_at":"2026-11-15T14:37:36+00:00","updated_at":"2026-11-15T14:39:26+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-15T14:37:36Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"EWWW Image Optimizer: stored XSS through 8.9.1 lets attackers inject scripts","impact":"medium","summary":"EWWW Image Optimizer, a WordPress image compression plugin, has a stored cross-site scripting flaw in versions through 8.9.1. An attacker who can store input in the plugin can run scripts in the browsers of users who view the affected pages.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","ewww-image-optimizer"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker scripts run in visitors' browsers on the site","analyst_note":"Find the fixed version and the exact input vector from the NVD entry or the plugin's changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-124254.","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or in `ewww-image-optimizer.php` header\n- Confirm whether the installed version is `8.9.1` or earlier\n- unknown","plain_action":"","product_name":"EWWW Image Optimizer","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running EWWW Image Optimizer through version 8.9.1 are in scope, since the flaw is stored XSS in the plugin. Who can exploit it and under what settings is unknown from the sources. Sites not running this plugin can skip it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000755,"input_tokens":4566,"output_tokens":597,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the fixed version and the exact input vector from the NVD entry or the plugin's changelog at https://nvd.nist.gov/vuln/detail/CVE-2026-124254.","search":"'-124254':14A,17A '-2026':13A,16A '8.9.1':7A,50B,108C 'affect':71B,101C 'allow':97C 'attack':9A,52B 'browser':65B 'compress':37B 'cross':43B,82C 'cross-sit':42B,81C 'cve':12A,15A 'ewww':1A,18A,22B,31B,90C,94C,102C 'ewww-image-optim':21B,93C 'exact':87C 'flaw':46B 'generat':80C 'imag':2A,23B,32B,36B,91C,95C,103C 'image':19A 'improp':73C 'inject':10A 'input':56B,76C 'issu':100C 'let':8A 'llc':89C 'n/a':106C 'neutral':74C 'optim':3A,24B,33B,92C,96C,104C 'optimizer':20A 'packag':25B 'page':72B,79C 'plugin':29B,38B,59B 'run':61B 'script':11A,45B,62B,84C 'site':44B,83C 'store':4A,41B,55B,98C 'user':67B 'version':48B 'view':69B 'vulner':85C 'web':78C 'wordpress':26B,28B,35B 'wordpress-plugin':27B 'www':88C 'xss':5A,30B 'xss.this':99C","nicknames":[],"mitigations":[],"who_affected":"WordPress sites running the EWWW Image Optimizer plugin at version 8.9.1 or earlier. The record says stored XSS but not which input or what privilege is needed, so treat any site with the plugin as in scope until the vendor says more. Sites without the plugin, or on 8.9.2 or later, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["ewwwimageoptimizer","imageoptimizer"],"ptokens":["ewww","image","optimizer"],"labels":["ewwwimageoptimizer","high","package","vendor","wordpress","wordpressplugin","xss"],"campaign_type":null,"search_a":"'-124254':14A,17A '-2026':13A,16A '8.9.1':7A 'attack':9A 'cve':12A,15A 'ewww':1A,18A 'imag':2A 'image':19A 'inject':10A 'let':8A 'optim':3A 'optimizer':20A 'script':11A 'store':4A 'xss':5A","search_b":"'8.9.1':50B 'affect':71B 'attack':52B 'browser':65B 'compress':37B 'cross':43B 'cross-sit':42B 'ewww':22B,31B 'ewww-image-optim':21B 'flaw':46B 'imag':23B,32B,36B 'input':56B 'optim':24B,33B 'packag':25B 'page':72B 'plugin':29B,38B,59B 'run':61B 'script':45B,62B 'site':44B 'store':41B,55B 'user':67B 'version':48B 'view':69B 'wordpress':26B,28B,35B 'wordpress-plugin':27B 'xss':30B","search_c":"'8.9.1':108C 'affect':101C 'allow':97C 'cross':82C 'cross-sit':81C 'ewww':90C,94C,102C 'ewww-image-optim':93C 'exact':87C 'generat':80C 'imag':91C,95C,103C 'improp':73C 'input':76C 'issu':100C 'llc':89C 'n/a':106C 'neutral':74C 'optim':92C,96C,104C 'page':79C 'script':84C 'site':83C 'store':98C 'vulner':85C 'web':78C 'www':88C 'xss.this':99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-15T14:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124254","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124254","severity":null,"published_at":"2026-11-15T14:17:21+00:00","modified_at":"2026-11-15T14:17:21+00:00","first_seen_at":"2026-11-15T14:36:14+00:00","fetched_at":"2026-11-15T14:36:14+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124254:4047","url":"https://plugins.svn.wordpress.org/ewww-image-optimizer/trunk/changelog.txt","severity":null,"published_at":"2026-11-15T14:39:26+00:00","modified_at":"2026-11-15T14:39:26+00:00","first_seen_at":"2026-11-15T14:39:26+00:00","fetched_at":"2026-11-15T14:39:26+00:00","note":"NVD/Patchstack-CNA record says stored XSS in EWWW Image Optimizer through 8.9.1 (CVSS 7.1, PR:N per CNA vector). No vendor advisory or Patchstack page for this CVE found; input vector and privilege level not stated. Do not confuse with CVE-2026-91049 (author+, fixed 8.9.1). Changelog shows 8.9.2 (Nov 10) as the first release after 8.9.1 with a security entry (HTML attribute parsing in all front-end filters), but it does not name this CVE, so fix is inferred, not verified.","cites":["https://plugins.svn.wordpress.org/ewww-image-optimizer/trunk/changelog.txt","https://github.com/nosilver4u/ewww-image-optimizer/releases","https://www.rapid7.com/db/vulnerabilities/cve-2026-124254/"]}],"documents":[{"id":163844,"url":"https://plugins.svn.wordpress.org/ewww-image-optimizer/trunk/changelog.txt","title":"EWWW Image Optimizer changelog (8.9.2, 8.9.1)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":163845,"url":"https://github.com/nosilver4u/ewww-image-optimizer/releases","title":"EWWW Image Optimizer releases (GitHub)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":163846,"url":"https://www.rapid7.com/db/vulnerabilities/cve-2026-124254/","title":"Rapid7: CVE-2026-124254","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}