Vulnerabilities / EWWW Image Optimizer
EWWW Image Optimizer vulnerabilities
Advisories WPSec published for EWWW Image Optimizer. Other sources may list more. Its attack surface: EWWW Image Optimizer on WPSec AttackSurface.
| Published | ID | Vulnerability | Severity | Fixed in |
|---|---|---|---|---|
| 2026-10-14 | WPSEC-2026-0964 | EWWW Image Optimizer <= 8.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load 'data-script' and 'data-link' Attributes | Medium 4.9 | 8.9.0 |
| 2026-10-02 | WPSEC-2026-0243 | EWWW Image Optimizer <= 8.7.7 - Authenticated (Contributor+) PHP Object Injection via 'eio_page_settings' Post Meta | High 7.5 | 8.8.0 |
| 2026-10-02 | WPSEC-2026-0242 | EWWW Image Optimizer <= 8.7.7 - Authenticated (Administrator+) Limited File Deletion and Renaming via WebP Migration on Multisite | Medium 4.4 | 8.8.0 |
| 2026-10-02 | WPSEC-2026-0241 | EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via Request URI in Support Debug Information | Medium 6.1 | 8.8.0 |
License: CC BY 4.0