EUVD-2026-91894
GHSA-g6w7-2x8j-gggq
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious URL with script in REQUEST_URI
-
DeliveryPhish victim to click link
-
ExploitReflected payload emitted in HelpScout block
-
ExecutionScript executes in victim browser
-
ImpactSession hijack or admin actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the plugin's enable_help option to be active, since the vulnerable HelpScout Beacon script block (which reflects the unescaped REQUEST_URI parameter key) is only emitted under that setting - sites without enable_help enabled are not exploitable. It further requires victim user interaction (UI:R): the attacker must trick a user into clicking a crafted link. The attacker needs no authentication (PR:N) and no special access beyond the ability to deliver a URL, but impact is confined to the victim's browser context (reflected, not stored). |
| Impact | This is a moderate-severity Reflected XSS (CVSS 6.1, CWE-79) whose real-world priority is tempered by two independent gating factors. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) shows a network-reachable, low-complexity, unauthenticated vector, but mandatory user interaction (UI:R - the victim must click a crafted link) and limited scope-changed browser-context impact (C:L/I:L/A:N) keep it short of a critical server-side flaw. Crucially, the description adds a condition absent from the raw CVSS: exploitation only works when the plugin's enable_help option is active, because the vulnerable HelpScout Beacon script block is only emitted then - meaning many installs are not exploitable at all. No EPSS score was supplied, the CVE is NOT on CISA KEV, and no POC is referenced, so there is no public exploit identified at time of analysis. The signals are internally consistent (no CVSS-vs-description conflict), pointing to a genuine-but-not-urgent issue: patch in routine cycles rather than emergency, prioritizing sites known to have enable_help enabled. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts a malicious URL targeting a WordPress site running EWWW Image Optimizer (<=8.7.7) with the enable_help option enabled, embedding script via the REQUEST_URI parameter key that is reflected unescaped into the HelpScout Beacon block. The attacker sends the link to a victim (e.g., an administrator) via phishing; when the victim clicks it, the script executes in their browser session. No public exploit code is referenced, but reflected XSS of this type is straightforward to weaponize given low attack complexity. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 03, 2026
Reflected cross-site scripting in the EWWW Image Optimizer plugin for WordPress (all versions up to and including 8.7.7) lets unauthenticated remote attackers inject arbitrary script into a page by supplying a crafted REQUEST_URI parameter key that is reflected without adequate sanitization or escaping into the plugin's HelpScout Beacon script block. Per the CVSS vector (PR:N, UI:R, S:C), no attacker authentication is required, but a victim must be tricked into clicking a crafted link, and the injected script runs only in that victim's browser session - this is a reflected, not stored, issue. Two independent gating factors temper real-world priority: the plugin's enable_help option must be active (the vulnerable beacon block is emitted only when it is), and exploitation depends entirely on user interaction; reflected cross-site scripting is rated 6.1 and no public exploit identified at time of analysis.
RemediationAI
No vendor-released patched version is independently confirmed in the available data; the only fix signal is an upstream code change to trunk (Trac changeset 3712144, https://plugins.trac.wordpress.org/changeset/3712144/ewww-image-optimizer/trunk/classes/class-base.php, with revision view at https://plugins.trac.wordpress.org/browser/ewww-image-optimizer?rev=3712144), so treat this as upstream fix available (PR/commit) with a patched tagged release not independently confirmed - monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a9295e78-b45d-4738-b14e-1a16d5915920?source=cve and the WordPress plugin repository for a release above 8.7.7 and upgrade immediately once published. The most effective compensating control is to disable the plugin's enable_help setting, which prevents the vulnerable HelpScout Beacon script block from being emitted at all and therefore removes the reflection sink; the trade-off is that administrators lose the in-plugin HelpScout help/beacon widget, and any other functionality tied to that option. If the plugin's help feature is not needed, deactivating the plugin entirely eliminates exposure. Additional layered mitigations with their trade-offs: deploy a WAF or reverse-proxy rule that blocks requests whose REQUEST_URI / parameter names contain script-context metacharacters (angle brackets, quotes, event-handler patterns) aimed at the plugin's pages - effective but prone to false positives and bypass via encoding, and it does not fix the underlying code. Restrict access to plugin admin pages to trusted networks where feasible, and apply output-escaping hardening (esc_js/esc_attr around the reflected value) as a manual patch only if you can maintain a forked copy, since hand-editing plugin code will be overwritten on the next update. Because exploitation requires victim interaction, user awareness around unsolicited links to the site plus standard browser-side XSS protections reduce, but do not remove, attack success.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The issue is a classic CWE-79 improper neutralization of input during web page generation, implemented in PHP within the WordPress plugin ecosystem. The plugin reads the request URI / parameter key from the REQUEST_URI server variable and interpolates it into an inline HelpScout Beacon JavaScript block without context-appropriate escaping (such as esc_js or esc_attr), so attacker-controlled characters break out of the script/attribute context and execute as markup or script in the victim's browser. The referenced source locations - classes/class-base.php around lines 269, 290 and 305, and bulk.php around lines 462 and 470 - show the sink and the surrounding logic that emits the beacon block; the CPE cpe:2.3:a:nosilver4u:ewww_image_optimizer:*:*:*:*:*:*:*:* with a wildcard version confirms the affected component is the plugin itself rather than WordPress core or a hosting layer. Because the injected payload executes in the origin of the affected WordPress site, the CVSS scope change (S:C) reflects that the vulnerable component is the plugin code while the impacted component is the victim's browser session, enabling session token theft, authenticated action forgery, or drive-by browser compromise limited to the victim's context (C:L/I:L, A:N). The presence of a Trac changeset (rev 3712144) touching trunk/classes/class-base.php indicates the reflection/escaping logic was the subject of an upstream code change.
Know when Ewww Image Optimizer gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network-delivered reflected XSS requiring victim click (UI:R), executing in browser with scope change (S:C) and limited C/I impact; enable_help dependency is a config gate, not CVSS complexity.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the enable_help option is active, as the vulnerable HelpScout Beacon script block is only emitted when that setting is enabled.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
More in Ewww Image Optimizer
View allStored cross-site scripting in EWWW Image Optimizer before 8.7.7 allows authenticated users with author-level or higher
Cross-site scripting in EWWW Image Optimizer 8.7.7 and earlier allows an authenticated WordPress user with Contributor-l
Stored XSS in the EWWW Image Optimizer WordPress plugin (all versions through 8.7.3) lets authenticated attackers holdin
Exploit-DB