CVE-2026-91049— EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute
Quick assessment
Affected
Unknown EWWW Image Optimizer
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
EWWW Image Optimizer WordPress 插件在 8.9.1 版本之前，未对帖子内容中的某个值进行适当的清理和限制，便将其用于在页面中动态加载并执行脚本。这使得拥有作者级别及以上权限的已认证攻击者能够注入任意 Web 脚本，这些脚本将在任何查看受影响页面的用户（包括管理员）的会话中执行。 此问题是对 CVE-2026-15446 的不完整修复：自 8.7.4 版本起所添加的源站和路径限制均存在绕过方法，因此 8.7.4 至 8.9.0 版本仍然受此漏洞影响。
Possible ATT&CK Techniques 3 AI
T1055.001 · Dynamic-link Library Injection T1071.001 · Web Protocols T1190 · Exploit Public-Facing ApplicationAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Unknown | EWWW Image Optimizer | 8.7.4< 8.9.1 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-91049
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute
Source: CVE Program / CVE List V5
Vulnerability Description
The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.
This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | EWWW Image Optimizer | 8.7.4 ~ 8.9.1 | - |
|
II. Public POCs for CVE-2026-91049
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-91049
请登录查看更多情报信息。
Other References for CVE-2026-91049 (1)
-
https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-11-05 · 29 CVEs total
| CVE-2026-107776 | 2.2 LOW | Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Without Payment via Discount Coup |
| CVE-2026-90963 | Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Property Listing and Agent Con | |
| CVE-2026-16304 | WP Event Manager < 3.4.2 - Subscriber+ Arbitrary Post Takeover via event_organizer_ids | |
| CVE-2026-85347 | FV Player < 7.5.56.7212 - Contributor+ Stored XSS via Text Lightbox Caption | |
| CVE-2026-85351 | FV Player < 7.5.56.7212 - Contributor+ SSRF via Media Library Import | |
| CVE-2026-85346 | FV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Hand | |
| CVE-2026-19256 | All In One Login 2.4.0 - 2.4.1 - Unauthenticated Account Takeover via Email OTP Brute Forc | |
| CVE-2026-86442 | WP Event Manager 3.4.0 - 3.4.1 - Unauthenticated Unpublished Post Overwrite via IDOR | |
| CVE-2026-86795 | Community Events < 1.6.0 - Unauthenticated Pending Events Disclosure via ajax_admin_event_ | |
| CVE-2026-85570 | Tutor LMS 1.6.4 - 4.1.3 - Subscriber+ Quiz Answer Key Disclosure | |
| CVE-2026-87856 | Subscriptions for WooCommerce 2.0.0 - 2.1.0 - Unauthenticated Membership Content Restricti | |
| CVE-2026-88814 | YITH WooCommerce Gift Cards < 4.38.1 - Unauthenticated Gift Card Balance Double-Spending v | |
| CVE-2026-90964 | Essential Real Estate < 5.3.5 - Unauthenticated Arbitrary Email Sending | |
| CVE-2026-90966 | Essential Real Estate < 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Pai | |
| CVE-2026-90965 | Essential Real Estate < 5.3.5 - Unauthenticated Unpublished Listing Image Disclosure | |
| CVE-2025-15701 | Easy Social Icons < 4.0.3 - Admin+ Stored XSS via Icon Color Settings | |
| CVE-2025-15702 | Cloud Blocks <= 1.1.8 - Unauthenticated Stored XSS | |
| CVE-2026-90967 | Essential Real Estate < 5.3.5 - Customer+ Invoice PII Disclosure via IDOR | |
| CVE-2026-100144 | IVPAY payments <= 1.0.8 - Unauthenticated SQLi via 'payment_id' Parameter | |
| CVE-2026-107775 | Dokan < 5.3.3 - Admin+ Cross-Site Vendor Activation |
Showing top 20 of 29 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: EWWW Image Optimizer
-
CVE-2026-92826
EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripti -
CVE-2026-97067
WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site -
CVE-2026-91051
EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Inje -
CVE-2026-91072
EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and D -
CVE-2026-91011
EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image
Same vendor: Unknown
-
CVE-2026-107776
Dokan < 5.3.3 - Vendor+ Reverse Withdrawal Ledger Credit Wit -
CVE-2026-100109
Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated P -
CVE-2026-109150
WP PageNavi Style <= 1.4 - Stored XSS via CSRF -
CVE-2026-107786
CatFolders < 2.5.7 - Author+ SQLi via 'sortFile' Setting -
CVE-2026-107787
CatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and