---
id: "CVE-2026-124254"
page: "https://infrastack.ai/live/CVE-2026-124254"
kind: "vulnerability"
aliases: ["CVE-2026-124254"]
title: "EWWW Image Optimizer: stored XSS through 8.9.1 lets attackers inject scripts"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "EWWW Image Optimizer", "fixed": ["8.9.2"], "affected": "<= 8.9.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["ewww-image-optimizer", "package", "wordpress", "wordpress-plugin", "xss"]
not_affected_if: ["plugin-not-installed", "version-8.9.2-or-later"]
published_at: "2026-11-15T14:17:21+00:00"
first_seen_at: "2026-11-15T14:36:14+00:00"
updated_at: "2026-11-15T14:39:26+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124254", "first_seen_at": "2026-11-15T14:36:14+00:00"}, {"source": "analyst", "url": "https://www.rapid7.com/db/vulnerabilities/cve-2026-124254/", "first_seen_at": "2026-11-15T14:39:26+00:00", "cites": ["https://www.rapid7.com/db/vulnerabilities/cve-2026-124254/", "https://plugins.svn.wordpress.org/ewww-image-optimizer/trunk/changelog.txt", "https://github.com/nosilver4u/ewww-image-optimizer/releases"]}]
exploit_sources: []
---

# EWWW Image Optimizer: stored XSS through 8.9.1 lets attackers inject scripts

Link for people: https://infrastack.ai/live/CVE-2026-124254 (this .md is for agents)

EWWW Image Optimizer, a WordPress image compression plugin, has a stored cross-site scripting flaw in versions through 8.9.1. An attacker who can store input in the plugin can run scripts in the browsers of users who view the affected pages.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:EWWW Image Optimizer affected <= 8.9.1 fixed 8.9.2

## How to check

- Run wp plugin get ewww-image-optimizer --field=version, or read the Version header in wp-content/plugins/ewww-image-optimizer/ewww-image-optimizer.php, or see Plugins in wp-admin.
- Exposed if the version is 8.9.1 or earlier; 8.9.2 or later is the release that follows the affected range.
- Input vector and required privilege are not stated in the sources.

## Fix

Update EWWW Image Optimizer to 8.9.2 or later (latest release, Nov 10 2026). The 8.9.2 changelog lists 'security: improved HTML attribute parsing applied to all front-end filters' but does not name this CVE; confirm against the Patchstack/NVD entry when it is updated.

## Timeline

- 2026-11-15T14:36:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124254
- 2026-11-15T14:39:26+00:00 analyst https://www.rapid7.com/db/vulnerabilities/cve-2026-124254/ — NVD/Patchstack-CNA record says stored XSS in EWWW Image Optimizer through 8.9.1 (CVSS 7.1, PR:N per CNA vector). No vendor advisory or Patchstack page for this CVE found; input vector and privilege level not stated. Do not confuse with CVE-2026-91049 (author+, fixed 8.9.1). Changelog shows 8.9.2 (Nov 10) as the first release after 8.9.1 with a security entry (HTML attribute parsing in all front-end filters), but it does not name this CVE, so fix is inferred, not verified.

## Documents

- [describes] Rapid7: CVE-2026-124254 https://www.rapid7.com/db/vulnerabilities/cve-2026-124254/
- [fix] EWWW Image Optimizer changelog (8.9.2, 8.9.1) https://plugins.svn.wordpress.org/ewww-image-optimizer/trunk/changelog.txt
- [fix] EWWW Image Optimizer releases (GitHub) https://github.com/nosilver4u/ewww-image-optimizer/releases

## From the sources

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Exactly WWW LLC EWWW Image Optimizer ewww-image-optimizer allows Stored XSS.This issue affects EWWW Image Optimizer: from n/a through 8.9.1.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_