CVE-2026-91011: EWWW Image Optimizer XSS Vulnerability

CVE-2026-91011 Overview

CVE-2026-91011 is a stored Cross-Site Scripting (XSS) vulnerability in the EWWW Image Optimizer WordPress plugin before version 8.7.7. The plugin rewrites page output to optimize image delivery but fails to properly escape image attribute values during this process. Authenticated users with author-level access or higher can inject arbitrary JavaScript that persists in published content. The malicious payload executes in the browser of any user who later views the affected page, including administrators.

Critical Impact
Authenticated attackers with author privileges can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and unauthorized administrative actions.

Affected Products

EWWW Image Optimizer WordPress plugin versions prior to 8.7.7

Discovery Timeline

2026-09-17 - CVE-2026-91011 published to the National Vulnerability Database (NVD)
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-91011

Vulnerability Analysis

The vulnerability is classified as Cross-Site Scripting under [CWE-79]. The EWWW Image Optimizer plugin intercepts page output and rewrites <img> tags to apply optimization directives such as lazy loading and format conversion. During this rewrite, the plugin reads existing image attribute values and re-emits them into the response without applying proper HTML output escaping.

Because the injected payload persists in stored post content, the attack is stored (Type II) XSS rather than reflected. Every subsequent visitor to the affected page executes the attacker's JavaScript in the origin of the WordPress site. When an administrator views the page, the attacker can leverage the administrative session to create users, install plugins, or exfiltrate data.

Root Cause

The plugin's output rewriter treats image attribute values as trusted strings when reconstructing markup. Values originally supplied by an authenticated author, such as crafted alt, title, or custom data-* attributes on image tags, are re-emitted without HTML entity encoding. Attribute delimiters and script contexts are not sanitized, allowing an attacker to break out of the attribute context and inject executable JavaScript.

Attack Vector

An attacker requires authenticated access at the author level or above on a WordPress site running a vulnerable version of the plugin. The attacker publishes or edits a post containing an image with attribute values crafted to break out of the attribute context. When the plugin's output rewriter processes the page, the payload is written into the rendered HTML. Any subsequent page view executes the JavaScript in the visitor's browser, satisfying the user-interaction requirement in the CVSS vector.

For technical details, see the WPScan Vulnerability Report #334f14d5.

Detection Methods for CVE-2026-91011

Indicators of Compromise

Image tags in published posts containing unusual attribute values, embedded quotes, angle brackets, or on* event handlers such as onerror, onload, or onmouseover.
Unexpected WordPress administrator accounts, role changes, or plugin installations following author-level activity.
Outbound requests from browsers of authenticated administrators to unfamiliar domains shortly after viewing author-authored content.

Detection Strategies

Inspect the wp_posts table for image markup containing suspicious characters in attribute values, particularly single or double quotes followed by whitespace and identifiers beginning with on.
Deploy Content Security Policy (CSP) reporting to surface inline script executions originating from post content.
Correlate post edit events by author-level users with subsequent administrator session anomalies in web server logs.

Monitoring Recommendations

Monitor WordPress audit logs for post publish and update events from non-editor accounts, followed by administrator page views of the same URLs.
Alert on outbound HTTP requests from administrator browsers to domains not present in the site's approved asset list.
Track the installed version of the EWWW Image Optimizer plugin across managed WordPress instances and flag hosts running versions before 8.7.7.

How to Mitigate CVE-2026-91011

Immediate Actions Required

Update the EWWW Image Optimizer plugin to version 8.7.7 or later on all WordPress installations.
Audit author-level and higher accounts for legitimacy and revoke access for any account that is inactive or unrecognized.
Review recently published or modified posts containing images for injected script payloads and remove malicious content.

Patch Information

Upgrade the EWWW Image Optimizer plugin to version 8.7.7 or later, which properly escapes image attribute values during output rewriting. Refer to the WPScan Vulnerability Report #334f14d5 for advisory details.

Workarounds

Restrict post publishing to trusted editor and administrator roles until the plugin is updated.
Temporarily deactivate the EWWW Image Optimizer plugin if immediate patching is not feasible.
Enforce a strict Content Security Policy that disallows inline scripts to reduce the impact of injected payloads.

bash

# Update the EWWW Image Optimizer plugin using WP-CLI
wp plugin update ewww-image-optimizer --version=8.7.7

# Verify installed version
wp plugin get ewww-image-optimizer --field=version