EWWW Image Optimizer CVE-2026-97067

Exploitation requires an authenticated WordPress account with at least Contributor-level privileges (PR:L) on a site running EWWW Image Optimizer version 8.7.7 or earlier, plus victim user interaction (UI:R) - a higher-privileged user must view the page carrying the injected payload for the script to fire. The scope change (S:C) means the script runs in the victim's browser session rather than the attacker's. Limiting factors: the need for a pre-existing Contributor account (sites that do not allow untrusted contributor registrations are largely insulated), the requirement for victim interaction, and the fact that impact is confined to Low confidentiality/integrity/availability rather than direct server compromise.

This is a moderate-severity stored/reflected Cross-Site Scripting flaw whose real-world urgency is limited by its access requirements. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, base 6.5) shows network reachability and low attack complexity, but requires an authenticated account at PR:L - described as Contributor level - plus victim user interaction (UI:R). The scope change (S:C) reflects script executing in another user's browser session/context, which raises the score, but the impacts are only Low across confidentiality, integrity, and availability. No EPSS probability, CISA KEV listing, or public POC is provided in the input, so there is no evidence of active exploitation or a ready-made exploit; exploitation status is best described as no public exploit identified at time of analysis. Net assessment: a real but low-to-medium priority issue - the CVSS of 6.5 is inflated relative to practical risk because it presupposes a hostile Contributor already exists on the site, which is a meaningful barrier for most WordPress deployments. This is a defense-in-depth patch rather than an emergency.

An attacker who holds (or has phished/registered) a Contributor-level account on a WordPress site running EWWW Image Optimizer <= 8.7.7 injects a malicious JavaScript payload into a plugin-handled field that is not properly sanitized/output-encoded. When a higher-privileged user such as an administrator views the affected page, the script executes in their authenticated browser context (S:C), potentially enabling session-token theft or admin actions. No public proof-of-concept is referenced in the available data.