CVE-2026-15446

Name of the Vulnerable Software and Affected Versions EWWW Image Optimizer versions prior to 8.7.4

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. An attacker can embed a crafted img element with the class lazyload and a data-script attribute pointing to a malicious URL within post content. The plugin's bundled lazysizes ls.unveilhooks addon then dynamically creates and inserts a script element into the Document Object Model (DOM) when a user views the page, executing the arbitrary web script.

Recommendations Update to version 8.7.4 or later.