---
id: CVE-2026-91049
title: >-
  EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy
  Load Attribute
summary: >-
  The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly
  sanitize and restrict a value in post content before using it to dynamically
  load and execute a script in the page, allowing authenticated attackers with
  author-lev…
severity: medium
cvss: 6.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H'
cvssSource: adp
cwe:
  - CWE-79
product: EWWW Image Optimizer
affected:
  - ewww_image_optimizer >= 8.7.4 < 8.9.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-06T11:49:52.695338Z'
published: '2026-11-05'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T12:02:36.318Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-91049'
references:
  - url: 'https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7/'
tags:
  - cve.org
epss: 0.00208
epssPercentile: 0.10929
ingestedAt: '2026-11-05T21:36:00.785Z'
---

## Overview

The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.

This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.

## Affected

- `ewww_image_optimizer >= 8.7.4 < 8.9.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.