EWWW Image Optimizer <= 8.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load 'data-script' and 'data-link' Attributes
- ID
- WPSEC-2026-0964
- Plugin
- EWWW Image Optimizer (ewww-image-optimizer)
- Affected
- all versions before 8.9.0
- Remediation
- Update to 8.9.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-14
- Attack surface
- EWWW Image Optimizer on WPSec AttackSurface
- Fix released
- Published
Description
The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load 'data-script', 'data-require' and 'data-link' attributes in all versions up to, and including, 8.8.0, due to an insufficient safe-domain and safe-path allowlist check in the lazy loader script. The check compared only the URL hostname, ignoring the port, and matched the raw, undecoded pathname against the allowed plugin, theme and wp-includes paths, so a URL containing percent-encoded path separators could pass the check while the web server resolves it to a different resource on the same host. This makes it possible for authenticated attackers, with contributor-level access and above, to inject web scripts or stylesheets that run whenever a user opens an injected page. Lazy Load must be enabled, the web server must normalise encoded path separators, and the attacker needs a resource on the allowed host that returns script content they control.
References
- https://wpsec.com/vuln/WPSEC-2026-0964/
- https://plugins.svn.wordpress.org/ewww-image-optimizer/tags/8.9.0/
- https://wordpress.org/plugins/ewww-image-optimizer/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS