{"id":"CVE-2026-91049","published":"2026-11-05T06:17:10.317","lastModified":"2026-11-05T06:17:10.317","description":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":[],"vendors":[],"products":[],"references":[{"url":"https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":null}