Shane Bishop
Monthly
Unauthenticated Cross-Site Scripting in the EWWW Image Optimizer WordPress plugin (versions ≤ 8.7.6) enables remote attackers to inject arbitrary JavaScript into pages served to authenticated site visitors, including administrators. With Scope:Changed in the provided CVSS vector, successful exploitation can break out of the plugin's security boundary - allowing session token theft, admin-level action hijacking, or persistent backdoor injection via malicious script execution in a privileged browser context. Reported by Patchstack; no active exploitation or public PoC has been identified at time of analysis.
Unauthenticated Cross-Site Scripting in the EWWW Image Optimizer WordPress plugin (versions ≤ 8.7.6) enables remote attackers to inject arbitrary JavaScript into pages served to authenticated site visitors, including administrators. With Scope:Changed in the provided CVSS vector, successful exploitation can break out of the plugin's security boundary - allowing session token theft, admin-level action hijacking, or persistent backdoor injection via malicious script execution in a privileged browser context. Reported by Patchstack; no active exploitation or public PoC has been identified at time of analysis.