---
id: "CVE-2026-91049"
kind: "vulnerability"
aliases: ["CVE-2026-91049"]
title: "EWWW Image Optimizer WordPress plugin: post content injects scripts into viewer sessions"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ewww-image-optimizer", "package", "wordpress", "wordpress-plugin"]
not_affected_if: ["no-untrusted-authors", "plugin-not-installed", "version-8.9.1-or-later"]
published_at: "2026-11-05T06:17:10+00:00"
first_seen_at: "2026-11-05T06:31:53+00:00"
updated_at: "2026-11-05T06:32:57+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91049", "first_seen_at": "2026-11-05T06:31:53+00:00"}]
exploit_sources: []
---

# EWWW Image Optimizer WordPress plugin: post content injects scripts into viewer sessions

The EWWW Image Optimizer WordPress plugin before 8.9.1 loads and runs a script taken from post content without properly restricting it. An author-level user can inject scripts that run in the session of anyone who views the page, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed EWWW Image Optimizer version in the WordPress plugins list or `wp plugin get ewww-image-optimizer --field=version`
- Versions `8.7.4` through `8.9.0` are affected according to the sources

## Fix

- EWWW Image Optimizer: `8.9.1`

## Timeline

- 2026-11-05T06:31:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-91049

## From the sources

The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.

This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_