Ewww Image Optimizer
Monthly
Stored XSS in the EWWW Image Optimizer WordPress plugin (all versions through 8.7.3) lets authenticated attackers holding contributor-level accounts inject arbitrary JavaScript that executes silently in every subsequent visitor's browser. The exploit embeds a crafted img element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in post content; the plugin's bundled lazysizes ls.unveilhooks addon then dynamically inserts a script element into the DOM at page-view time with no domain validation. No public exploit has been identified at time of analysis and the CVE is absent from the CISA KEV catalog, though the fix commit fully exposes the exploitation mechanic.
Stored XSS in the EWWW Image Optimizer WordPress plugin (all versions through 8.7.3) lets authenticated attackers holding contributor-level accounts inject arbitrary JavaScript that executes silently in every subsequent visitor's browser. The exploit embeds a crafted img element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in post content; the plugin's bundled lazysizes ls.unveilhooks addon then dynamically inserts a script element into the DOM at page-view time with no domain validation. No public exploit has been identified at time of analysis and the CVE is absent from the CISA KEV catalog, though the fix commit fully exposes the exploitation mechanic.