The plugin’s bundled HTML parser fails to escape values that it re‑emits into element attributes, allowing an attacker to submit malicious content that is stored and later executed as cross‑site scripting in the browsers of any visitor to an affected page, including administrators. The flaw is a classic stored XSS vulnerability, meaning the injected payload persists in the site’s data and is rendered on multiple page loads. The impact is therefore the compromise of confidentiality, integrity, and availability of users’ browsers, as well as the potential for session hijacking or data theft.

WordPress sites running the Robin Image Optimizer plugin version 2.0.0 through 2.0.7 are affected. The issue is triggered when the non‑default image delivery mode is enabled, which is a configuration setting within the plugin. Any site administrator who has not upgraded beyond 2.0.7 remains vulnerable.

The CVSS score is 7.5, indicating high severity. The EPSS score is < 1%, indicating a low but non‑zero likelihood of exploitation. It is not listed in the CISA KEV catalog, so there is no confirmed exploit in the wild as of this analysis. The likely attack vector is unauthenticated and depends on an attacker being able to submit content to the plugin (for example, by uploading a WebP image with malicious attributes). Because the flaw operates on stored data, the risk escalates with the number of page views; a single exploit can affect all users of the targeted page.