EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via Request URI in Support Debug Information
- ID
- WPSEC-2026-0241
- Plugin
- EWWW Image Optimizer (ewww-image-optimizer)
- Affected
- all versions before 8.8.0
- Remediation
- Update to 8.8.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- EWWW Image Optimizer on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-92826, on 2026-10-02.
Description
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 8.7.7. The raw request URI is recorded in the plugin's debug information, which is then written into an inline JavaScript string for the embedded help (Help Scout Beacon) prefill using wp_kses_post() and manual quote escaping instead of JavaScript encoding. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in an administrator's browser on the Bulk Optimizer page if they can trick the administrator into following a crafted link, provided the plugin's Embedded Help option is enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0241/
- https://plugins.svn.wordpress.org/ewww-image-optimizer/tags/8.8.0/
- https://wordpress.org/plugins/ewww-image-optimizer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS