EWWW Image Optimizer — Vulnerabilities & Security Advisories 11

All 11 CVE vulnerabilities found in EWWW Image Optimizer, with AI-generated Chinese analysis, references, and POCs.

CVE ID	Title	CVSS	Severity	Published
CVE-2026-91049	EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute	-	-	2026-11-05
CVE-2026-92826	EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key CWE-79	6.1	Medium	2026-10-03
CVE-2026-97067	WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability CWE-79	6.5	Medium	2026-09-30
CVE-2026-91051	EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta	-	-	2026-09-30
CVE-2026-91072	EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler	-	-	2026-09-30
CVE-2026-91011	EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion	-	-	2026-09-17
CVE-2026-84773	WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability CWE-79	7.2	High	2026-09-03
CVE-2026-15446	EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content CWE-79	6.4	Medium	2026-08-19
CVE-2024-31924	WordPress EWWW Image Optimizer plugin <= 7.2.3 - Cross Site Request Forgery (CSRF) vulnerability CWE-352	4.3	Medium	2024-04-10
CVE-2023-40600	WordPress EWWW Image Optimizer Plugin <= 7.2.0 is vulnerable to Sensitive Data Exposure CWE-200	5.3	Medium	2023-11-30
CVE-2020-36750	EWWW Image Optimizer <= 5.8.1 - Cross-Site Request Forgery Bypass CWE-352	4.3	Medium	2023-07-12

All 11 known CVE vulnerabilities affecting EWWW Image Optimizer with full Chinese analysis, references, and POCs where available.