CVE-2026-89193

Name of the Vulnerable Software and Affected Versions Robin Image Optimizer versions prior to 2.0.8

Description The plugin fails to escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled. This allows unauthenticated users to submit content that is stored and subsequently executed as Cross-Site Scripting (XSS) in the browser of any user viewing an affected page, including administrators. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites.

Recommendations Update to version 2.0.8 or later.