Stored Cross-Site Scripting Vulnerability in EWWW Image Optimizer Plugin for WordPress

CVE-2026-15446

What is CVE-2026-15446?

The EWWW Image Optimizer plugin for WordPress contains a vulnerability that allows authenticated attackers with contributor-level access and above to exploit stored Cross-Site Scripting through insufficient input sanitization and output escaping. By embedding a specially crafted image element with a 'lazyload' class and a malicious 'data-script' attribute, attackers can inject arbitrary scripts into web pages. These scripts execute when users access any page containing the manipulated content, posing significant security risks to site visitors.

References