CVE-2026-91049 · Package
NO FIX YET · SEE WHAT TO DO
The EWWW Image Optimizer WordPress plugin before 8.9.1 loads and runs a script taken from post content without properly restricting it. An author-level user can inject scripts that run in the session of anyone who views the page, including administrators.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the EWWW Image Optimizer plugin from 8.7.4 through 8.9.0 are exposed, including versions with the earlier origin and path restrictions that were bypassable. Exploitation requires an author-level account or higher that can write post content, and the script runs for anyone who views the affected page, including administrators. Sites where only trusted administrators write content are at lower risk.
Not affected if no-untrusted-authors, plugin-not-installed, version-8.9.1-or-later
Who cares ewww-image-optimizer, wordpress, wordpress-plugin
wp plugin get ewww-image-optimizer --field=version8.7.4 through 8.9.0 are affected according to the sources8.9.1The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.
This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.