Technical impact
WordPress EWWW Image Optimizer version 8.9.1 and earlier are vulnerable to a stored cross‑site scripting flaw because the plugin does not properly neutralize input that is later rendered in web pages. An attacker who is able to inject malicious script into any field processed by the plugin can store that script in the site’s database, where it will execute in the browsers of visitors who view the affected content. The primary impact of this flaw is the ability for an attacker to run arbitrary client‑side code, which can be leveraged for session hijacking, defacement, or the delivery of further malicious payloads to site users.
Affected Systems
Exactly WWW LLC EWWW Image Optimizer, a WordPress plugin, with vulnerable releases from the first version through 8.9.1. WordPress sites that have installed this plugin within that version range are at risk.
Risk and Exploitability
The CVSS score of 7.1 indicates a high severity, and the vulnerability is not yet listed in CISA’s KEV catalog. Although the EPSS score is not publicly available, the nature of stored XSS combined with the widespread use of EWWW Image Optimizer suggests that exploitation is plausible. The likely attack vector is through the web application interface, where an intruder can inject malicious script into input fields that the plugin stores. Successful exploitation requires that the attacker can gain some form of data injection access to the plugin’s input handling routine; once achieved, the attack would affect all site visitors who render the stored data.
