{"affected":[{"defaultStatus":"unaffected","product":"EWWW Image Optimizer","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"8.9.1","status":"affected","version":"8.7.4","versionType":"semver"}]}],"cveId":"CVE-2026-91049","cwes":["CWE-79"],"description":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7/"}],"kev":null,"metrics":[],"modifiedAt":1793858427687,"publishedAt":1793858427687,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7/"}],"remediation":[],"revision":"6bcf9c1fc595e76ca791c212837ec50a9fd5cc7c963a8c4a3bd8e7b32974bec5","sources":[{"modifiedAt":1793858427687,"name":"CNA: WPScan","retrievedAt":1793859027818,"url":"https://www.cve.org/CVERecord?id=CVE-2026-91049"}],"ssvc":null,"status":"published","title":"EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute","updatedAt":1793859027818}