# EWWW Image Optimizer <= 8.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load 'data-script' and 'data-link' Attributes

- **ID:** WPSEC-2026-0964
- **Plugin:** EWWW Image Optimizer (`ewww-image-optimizer`), https://wordpress.org/plugins/ewww-image-optimizer/
- **Affected versions:** all versions before 8.9.0
- **Fixed in:** 8.9.0 (Update to 8.9.0 or later.)
- **Severity:** Medium 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin High, affected versions High (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ewww-image-optimizer
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0964/

## Description

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Lazy Load 'data-script', 'data-require' and 'data-link' attributes in all versions up to, and including, 8.8.0, due to an insufficient safe-domain and safe-path allowlist check in the lazy loader script. The check compared only the URL hostname, ignoring the port, and matched the raw, undecoded pathname against the allowed plugin, theme and wp-includes paths, so a URL containing percent-encoded path separators could pass the check while the web server resolves it to a different resource on the same host. This makes it possible for authenticated attackers, with contributor-level access and above, to inject web scripts or stylesheets that run whenever a user opens an injected page. Lazy Load must be enabled, the web server must normalise encoded path separators, and the attacker needs a resource on the allowed host that returns script content they control.

## References

- https://wpsec.com/vuln/WPSEC-2026-0964/
- https://plugins.svn.wordpress.org/ewww-image-optimizer/tags/8.9.0/
- https://wordpress.org/plugins/ewww-image-optimizer/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0964/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.