Cross-Site Scripting Vulnerability in Robin Image Optimizer WordPress Plugin
CVE-2026-89193
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 30 September 2026
Badges
What is CVE-2026-89193?
The Robin Image Optimizer plugin for WordPress, prior to version 2.0.8, contains a Cross-Site Scripting (XSS) vulnerability. This occurs due to inadequate escaping of values in its bundled HTML parser when attributes are emitted in certain non-default image delivery modes. As a result, this flaw permits unauthenticated users to insert malicious content, which could be executed in the browsers of users viewing affected pages, including administrators. It emphasizes the importance of updating the plugin to mitigate exposure to potential attacks.
Affected Version(s)
Robin Image Optimizer 2.0.0 < 2.0.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.