CVE-2026-91049

MediumCVSS 6.4

Published: 05/11/2026(UTC)Updated: 06/11/2026(UTC)Translated: 05/11/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: origin and path restrictions added from 8.7.4 onward were bypassable, so versions 8.7.4 through 8.9.0 remain affected.

Risk Assessment

Injected scripts may execute in an administrator's session, enabling site takeover, data theft, or creation of backdoor accounts.

Recommendation

Update the EWWW Image Optimizer plugin to version 8.9.1 or later. Review author post content for suspicious scripts.

Other vulnerabilities in EWWW Image Optimizer WordPress plugin

CVE-2026-91072Medium
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to.

Original NVD description (English source)

The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS