Robin Image Optimizer CVE-2026-89193

Requires the plugin's non-default image delivery mode to be enabled - the vulnerable code path in the bundled HTML parser only re-emits unescaped values into element attributes in that mode, so default installations are not affected. Exploitation is unauthenticated (PR:N) and network-reachable, but success depends on a victim (including an administrator) subsequently viewing the page where the payload is stored and rendered (UI:R). Affected versions are Robin Image Optimizer 2.0.0 up to but not including 2.0.8; upgrading to 2.0.8 or later removes the flaw.

Signals point to a real but conditional stored-XSS issue rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, base 7.5) shows an unauthenticated network vector, but two dampeners are baked in: AC:H reflects the requirement that a non-default image delivery mode be enabled, and UI:R requires a victim to view the affected page. CISA SSVC reinforces low urgency - Exploitation: none (no observed activity), Automatable: no - while rating Technical Impact as total. The C:H/I:H/A:H triple-high with S:U is atypical for stored XSS and looks inflated: XSS normally crosses a security boundary (browser context) warranting S:C but yields partial confidentiality/integrity impact, so I assess this closer to S:C/C:L/I:L/A:N (~6.1) unless the plugin exposes admin-level actions the injected script can drive. No EPSS score, no CISA KEV listing, and no public PoC were provided, and SSVC exploitation is 'none' - consistent with no evidence of exploitation. Net: a legitimate patch-soon issue for sites running the non-default delivery mode, not a drop-everything item.

With the plugin's non-default image delivery mode enabled, an unauthenticated attacker submits content containing a crafted attribute payload that the bundled HTML parser re-emits into an element attribute without escaping. The payload is stored and later rendered on an affected page; when an administrator or other user views that page, the script executes in their browser, enabling session/actions abuse. No public exploit code is identified at time of analysis.