PT-2026-94178

Name of the Vulnerable Software and Affected Versions EWWW Image Optimizer versions prior to 8.7.7 Description Authenticated users with author-level access and above can inject arbitrary JavaScript into published content. This occurs because the plugin fails to properly escape image attribute...

CVE-2026-91011: Improper Neutralization of Input During Web Page Generation

The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of an...