Description

Unauthenticated Cross Site Scripting (XSS) in EWWW Image Optimizer <= 8.7.6 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-03T17:17:28.263Z",
  "pubdate": "2026-09-03T17:17:28.263Z",
  "executiveSummary": "The EWWW Image Optimizer plugin for WordPress, specifically in versions 8.7.6 and below, is susceptible to an unauthenticated Cross-Site Scripting (XSS) vulnerability. This security flaw allows remote, unauthenticated attackers to inject malicious JavaScript into the victim's browser context without requiring prior access or specific user privileges. The vulnerability poses a significant risk to the integrity and security of the WordPress installation, as successful exploitation could lead to unauthorized actions performed on behalf of authenticated administrators. This includes potential session hijacking, unauthorized configuration changes, or the redirection of site traffic to malicious domains. The vulnerability is classified as critical due to the lack of authentication requirements, allowing any external actor to trigger the payload via specially crafted requests. Organizations utilizing affected versions are at risk of complete administrative account takeover and potential secondary attacks against users who interact with the compromised dashboard components.",
  "technicalDetails": "The vulnerability originates from improper neutralization of user-supplied input before rendering it in the administrative interface of the EWWW Image Optimizer plugin. In versions 8.7.6 and earlier, the plugin fails to perform adequate output encoding or context-aware sanitization on specific request parameters that are subsequently reflected in the browser. Because this input is processed without validation, an attacker can supply malicious HTML and JavaScript payloads through URL parameters or POST data.\nThe attack flow begins with the attacker crafting an HTTP request containing the malicious payload. Since the plugin's vulnerable endpoint does not enforce authentication or nonces for the affected component, the request is processed directly by the WordPress environment. Once the payload reaches the server, it is stored or reflected back to the client-side session of an administrator who views the plugin's settings or report pages. When the victim's browser processes the rendered output, the malicious script is executed within the context of the WordPress admin panel.\nThe scope of this vulnerability involves the injection of arbitrary scripts that run with the same permissions as the administrator. This allows the attacker to execute post-exploitation activities such as exfiltrating sensitive session tokens (cookies), modifying plugin settings to weaken overall security posture, or injecting malicious content into pages served to site visitors. Because the exploitation does not require the attacker to possess an account, it bypasses traditional access controls and authentication mechanisms. The lack of validation on critical parameters within the plugin's internal handling functions effectively turns the reflected input into a persistent or stored vector, depending on how the plugin persists these configurations. The impact is exacerbated by the privileged nature of the administrative session, as JavaScript running in the dashboard has full access to the WordPress REST API and the ability to execute administrative-level functions, effectively granting the attacker full control over the site’s plugin configuration and internal operations."
}