CVE-2026-91011

Name of the Vulnerable Software and Affected Versions EWWW Image Optimizer versions prior to 8.7.7

Description Authenticated users with author-level access and above can inject arbitrary JavaScript into published content. This occurs because the plugin fails to properly escape image attribute values during the page output rewrite process. The injected script is stored and subsequently executes in the browser of any user who views the affected page. This is a Stored Cross-Site Scripting (XSS) issue, where malicious scripts are permanently stored on the target server.

Recommendations Update EWWW Image Optimizer to version 8.7.7 or later.