[ CVE-2026-91049 · Published 5 Nov 2026 ]
Vulnerability in Unknown EWWW Image Optimizer
Not scored yet
No fix listed yet
[ Description ]Official description
The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators. This is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.