The EWWW Image Optimizer plugin through version 8.7.7 contains a contributor‑level cross‑site scripting flaw that allows an attacker to inject arbitrary script tags into the plugin’s output. This vulnerability permits the execution of malicious JavaScript in the browsers of users who view pages generated by the plugin, potentially leading to session hijacking, credential theft, or defacement of website content. The weakness is categorized as CWE‑79.

The flaw affects the WordPress EWWW Image Optimizer plugin maintained by Shane Bishop. All installations of the plugin at or below version 8.7.7 are vulnerable.

With a CVSS score of 6.5, the vulnerability presents a moderate risk. Exploitation requires an attacker to create or modify content through a contributor account, giving them a feasible web‑based attack vector. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog, indicating that no widely known exploit traffic has been recorded, but the flaw remains valuable for attackers who can elevate a contributor role or compromise the site’s authentication.