Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-10-06
Ewww Image Optimizer - Security Vulnerability (CVE-2026-92826)
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the enable_help option is active, as the vulnerable HelpScout Beacon script block is only emitted when that setting is enabled.
PLUGIN
Ewww Image Optimizer
CVE-2026-92826
Risk Score
Threat Entry
Updated 2026-09-30
Ewww Image Optimizer - Security Vulnerability (CVE-2026-97067)
Contributor Cross Site Scripting (XSS) in EWWW Image Optimizer
PLUGIN
Ewww Image Optimizer
CVE-2026-97067
Risk Score
Threat Entry
Updated 2026-09-30
EWWW Image Optimizer - Security Vulnerability (CVE-2026-91051)
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized when the post is rendered, allowing them to perform PHP Object Injection, which can lead to remote code execution when a suitable gadget chain is present via another installed EWWW Image Optimizer WordPress plugin before 8.8.0 or .
PLUGIN
EWWW Image Optimizer
CVE-2026-91051
Risk Score
Threat Entry
Updated 2026-09-30
EWWW Image Optimizer - Security Vulnerability (CVE-2026-91072)
The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with Administrator-level access rename or delete existing WebP-derivative image files outside that scope, including, on a multisite network, files belonging to a different site they have no access to.
PLUGIN
EWWW Image Optimizer
CVE-2026-91072
Risk Score
Threat Entry
Updated 2026-09-18
EWWW Image Optimizer - Security Vulnerability (CVE-2026-91011)
The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to inject arbitrary JavaScript that is stored in published content and executes in the browser of any user who later views the affected page.
PLUGIN
EWWW Image Optimizer
CVE-2026-91011
Risk Score
Threat Entry
Updated 2026-09-03
EWWW Image Optimizer - Cross-Site Scripting (XSS) (CVE-2026-84773)
Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer
PLUGIN
EWWW Image Optimizer
CVE-2026-84773
Risk Score
Threat Entry
Updated 2026-08-20
Ewww Image Optimizer - Cross-Site Scripting (XSS) (CVE-2026-15446)
The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is achieved by embedding a crafted img element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in post content,…
PLUGIN
Ewww Image Optimizer
CVE-2026-15446
Risk Score
Threat Entry
Updated 2026-06-17
Ewww Image Optimizer - Cross-Site Request Forgery (CSRF) (CVE-2024-31924)
Cross-Site Request Forgery (CSRF) vulnerability in nosilver4u EWWW Image Optimizer ewww-image-optimizer.This issue affects EWWW Image Optimizer: from n/a through
PLUGIN
Ewww Image Optimizer
CVE-2024-31924
Risk Score
Threat Entry
Updated 2026-06-17
EWWW Image Optimizer - Cross-Site Request Forgery (CSRF) (CVE-2020-36750)
The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or incorrect nonce validation on the ewww_ngg_bulk_init() function. This makes it possible for unauthenticated attackers to perform bulk image optimization via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
PLUGIN
EWWW Image Optimizer
CVE-2020-36750
Risk Score
Threat Entry
Updated 2026-06-17
Ewww Image Optimizer - Security Vulnerability (CVE-2016-20010)
EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHP 5.5.
PLUGIN
Ewww Image Optimizer
CVE-2016-20010
Risk Score