{"id":"CVE-2026-91049","kind":"vulnerability","aliases":["CVE-2026-91049"],"related":[],"title":"EWWW Image Optimizer WordPress plugin: post content injects scripts into viewer sessions","description":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","summary":"The EWWW Image Optimizer WordPress plugin before 8.9.1 loads and runs a script taken from post content without properly restricting it. An author-level user can inject scripts that run in the session of anyone who views the page, including administrators.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ewww-image-optimizer","package","wordpress","wordpress-plugin"],"not_affected_if":["no-untrusted-authors","plugin-not-installed","version-8.9.1-or-later"],"how_to_check":"- Check the installed EWWW Image Optimizer version in the WordPress plugins list or `wp plugin get ewww-image-optimizer --field=version`\n- Versions `8.7.4` through `8.9.0` are affected according to the sources","fix":"- EWWW Image Optimizer: `8.9.1`","status":"open","published_at":"2026-11-05T06:17:10+00:00","first_seen_at":"2026-11-05T06:31:53+00:00","triaged_at":"2026-11-05T06:32:57+00:00","updated_at":"2026-11-05T06:32:57+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T06:32:57Z","model":"claude-haiku-5-5","output":{"fix":"- EWWW Image Optimizer: `8.9.1`","reach":"internet","title":"EWWW Image Optimizer WordPress plugin: post content injects scripts into viewer sessions","impact":"high","summary":"The EWWW Image Optimizer WordPress plugin before 8.9.1 loads and runs a script taken from post content without properly restricting it. An author-level user can inject scripts that run in the session of anyone who views the page, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","ewww-image-optimizer"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Scripts run in administrator sessions, enabling site takeover","analyst_note":"Confirm the affected range and whether 8.9.1 is the complete fix; check the NVD and WordPress plugin changelog for details.","how_to_check":"- Check the installed EWWW Image Optimizer version in the WordPress plugins list or `wp plugin get ewww-image-optimizer --field=version`\n- Versions `8.7.4` through `8.9.0` are affected according to the sources","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","version-8.9.1-or-later","no-untrusted-authors"],"who_is_affected":"Sites running the EWWW Image Optimizer plugin from 8.7.4 through 8.9.0 are exposed, including versions with the earlier origin and path restrictions that were bypassable. Exploitation requires an author-level account or higher that can write post content, and the script runs for anyone who views the affected page, including administrators. Sites where only trusted administrators write content are at lower risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000749,"input_tokens":4306,"output_tokens":637,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-15446':140C '-2026':14A,17A,139C '-91049':15A,18A '8.7.4':148C,155C '8.9.0':157C '8.9.1':35B,77C 'access':109C 'add':146C 'administr':69B,131C 'affect':128C,159C 'allow':102C 'anyon':63B 'arbitrari':114C 'attack':104C 'authent':103C 'author':51B,107C 'author-level':50B,106C 'bypass':152C 'content':7A,44B,88C 'cve':13A,16A,138C 'dynam':93C 'ewww':1A,20B,29B,71C 'ewww-image-optim':19B 'execut':96C 'fix':136C 'imag':2A,21B,30B,72C 'includ':68B,130C 'incomplet':135C 'inject':8A,55B,113C 'level':52B,108C 'load':36B,94C 'onward':149C 'optim':3A,22B,31B,73C 'origin':142C 'packag':23B 'page':67B,101C,129C 'path':144C 'plugin':5A,27B,33B,75C 'post':6A,43B,87C 'proper':46B,80C 'remain':158C 'restrict':47B,83C,145C 'run':38B,58B,118C 'sanit':81C 'script':9A,40B,56B,98C,116C 'session':12A,61B,121C 'taken':41B 'use':90C 'user':53B,124C 'valu':85C 'version':154C 'view':65B,126C 'viewer':11A 'web':115C 'without':45B 'wordpress':4A,24B,26B,32B,74C 'wordpress-plugin':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the EWWW Image Optimizer plugin from 8.7.4 through 8.9.0 are exposed, including versions with the earlier origin and path restrictions that were bypassable. Exploitation requires an author-level account or higher that can write post content, and the script runs for anyone who views the affected page, including administrators. Sites where only trusted administrators write content are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["ewwwimageoptimizer","medium","package","wordpress","wordpressplugin"],"campaign_type":null,"first_public_at":"2026-11-05T06:17:10+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-91049","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91049","severity":null,"published_at":"2026-11-05T06:17:10+00:00","modified_at":"2026-11-05T06:17:10+00:00","first_seen_at":"2026-11-05T06:31:53+00:00","fetched_at":"2026-11-05T06:31:53+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}