86 matches found
WordPress EWWW Image Optimizer plugin <= 8.7.7 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Intrudify in WordPress Plugin EWWW Image Optimizer versions = 8.7.7...
EUVD-2026-89618
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote co...
EUVD-2026-89619
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on...
CVE-2026-91051
The EWWW Image Optimizer WordPress plugin versions before 8.8.0 is vulnerable to PHP Object Injection . Authenticated users with author-level permissions can store a serialized value in a post meta field, which is subsequently deserialized during post rendering. This flaw can lead to remote code ...
CVE-2026-91072
The EWWW Image Optimizer WordPress plugin (versions before 8.8.0 ) contains a vulnerability where a WebP-derivative file migration routine is not restricted to the current site's own uploads directory. An attacker with Administrator-level access can exploit this lack of confinement to rename or d...
CVE-2023-40600
CVE-2023-40600 EWWW Image Optimizer = 7.2.0 - 未经授权的敏感信息通过调试日志泄露 描述 EWWW Image Optimizer WordPress 插件在所有版本（包括 7.2.0 及以下版本）中，通过 debuglog 函数存在敏感信息泄露漏洞。这使得未认证的攻击者能够在启用调试日志记录时提取敏感的调试数据。 Severity: medium CVE ID: CVE-2023-40600 CVSS Score: 5.3 CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N...
CVE-2026-91011
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
WordPress EWWW Image Optimizer plugin < 8.7.7 - Author+ Stored XSS vulnerability
Author+ Stored XSS vulnerability discovered by Artus KG in WordPress Plugin EWWW Image Optimizer versions 8.7.7...
CVE-2026-91011
The EWWW Image Optimizer WordPress plugin, in versions before 8.7.7 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The issue stems from the failure to properly escape image attribute values during the page output rewriting process. This flaw allows authenticated users with author-l...
CVE-2026-91011 EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
CVE-2026-91011 EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
EUVD-2026-81354
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
CVE-2026-91011: Improper Neutralization of Input During Web Page Generation
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...
CVE-2026-84773
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...
CVE-2026-84773 WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...
CVE-2026-84773
EWWW Image Optimizer for WordPress (versions
CVE-2026-84773 WordPress EWWW Image Optimizer plugin <= 8.7.6 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...
EUVD-2026-70576
Unauthenticated Cross Site Scripting XSS in EWWW Image Optimizer = 8.7.6 versions...
