CVE-2026-91011

The EWWW Image Optimizer WordPress plugin (versions before 8.7.7 ) fails to properly escape image attribute values when rewriting page output, specifically through image class attribute backreference expansion . This allows authenticated users with author-level access or above to inject arbitrary...