The EWWW Image Optimizer plugin contains a stored cross‑site scripting flaw (CWE‑79) caused by insufficient input sanitization and output escaping that is triggered through a crafted img element with a class of lazyload and a data‑script attribute pointing to an external URL. Because the plugin’s lazysizes ls.unveilhooks addon blindly creates and inserts a script element into the DOM when the page loads, an authenticated attacker with contributor or higher permissions can inject arbitrary JavaScript that will run in the browsers of any visitor who views the affected post content. The primary impact is the execution of arbitrary code on user browsers, as described in the CVE record.

Any WordPress installation using a version of the EWWW Image Optimizer plugin up to and including 8.7.3 is affected. Sites that have contributors or higher‑level roles that can edit post content are particularly vulnerable, as the attacker needs to insert the malicious img markup into a post or page.

The flaw has a CVSS score of 6.4, indicating moderate severity, but its EPSS score is less than 1 %, suggesting a very low likelihood of exploitation at this time. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that the attacker first gain contributor or higher‑level access to the site and then add the malicious image to post content; once added, every visitor who loads the page will execute the injected script. The attack is feasible because the plugin does not sanitize or escape the data‑script attribute before rendering it into the page output.