CVE-2026-91011

CVE-2026-91011 affects the EWWW Image Optimizer WordPress plugin in versions before 8.7.7 . The root cause is improper escaping of image attribute values (specifically, backreference expansion in the image class attribute) when the plugin rewrites page output. An authenticated user with author-le...

GHSA-6Q5M-63H6-5X4V LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern

Summary The replacefirst filter in LiquidJS uses JavaScript's String.prototype.replace which interprets $& as a backreference to the matched substring. The filter only charges memoryLimit for the input string length, not the amplified output. An attacker can achieve exponential memory amplificati...