EWWW Image Optimizer CVE-2026-91011

Requires an authenticated WordPress account with author-level capability or higher (ability to publish content) on a site running EWWW Image Optimizer before 8.7.7 - this is the plugin's default output-rewriting behavior, no special feature toggle is named. Exploitation is stored/second-order: it also requires a victim to subsequently view the affected published page (UI:R) for the injected JavaScript to execute. Limiting factors: attacker must already hold a publishing role (not open to anonymous visitors), the payload only fires on victim page view, and impact is confined to the browser context of viewers (highest value when an administrator views the page, yielding potential account takeover).

This is a mid-severity stored XSS (CWE-79) whose real-world priority is moderate, not high. The vendor CVSS of 6.8 (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) appears inflated on two counts: (1) PR:H is wrong - the description explicitly requires only 'author-level access and above', which is a low-privilege contributor/author role, so PR:L is more accurate; and (2) the C:H/I:H/A:H triad overstates impact for a stored XSS that runs in a viewer's browser - standard scoring is a scope change with limited impact (S:C/C:L/I:L/A:N). A public POC exists (WPScan), which raises practical risk, but a POC is NOT active exploitation - status is 'publicly available exploit code exists'. No EPSS score and no KEV listing were provided, so there is no evidence of widespread or confirmed exploitation. The exploit requires an attacker to already hold a publishing account (author+) AND a victim to view the poisoned page (UI:R), which meaningfully limits opportunistic mass-exploitation. Net: patch on a normal cadence; elevate only if untrusted users hold author roles.

An attacker who holds (or phishes/registers into) an author-level account on a WordPress site running EWWW Image Optimizer < 8.7.7 publishes content containing an image whose attribute values carry a crafted JavaScript payload. Because the plugin rewrites page output without escaping those attribute values, the script is stored in the published page and executes in the browser of any later visitor - including an administrator reviewing the content, enabling session/cookie theft or admin-context actions. A public POC is available via WPScan.