{"cve":"CVE-2026-91049","enrichment":{"created":"2026-11-05T08:15:17.985308+00:00","updated":"2026-11-05T08:15:17.985324+00:00","vendors":[],"weaknesses":["CWE-79"]},"mitre":{"cpes":[],"created":"2026-11-05T06:00:27.687000+00:00","description":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/91xxx/CVE-2026-91049.json","references":["https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7/"],"title":"EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute","updated":"2026-11-05T06:00:27.687000+00:00","vendors":[],"weaknesses":[]},"nvd":{"cpes":[],"created":"2026-11-05T06:17:10.317000+00:00","description":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-91049.json","references":["https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7/"],"title":null,"updated":"2026-11-05T06:17:10.317000+00:00","vendors":[],"weaknesses":[]},"opencve":{"changes":[{"created":"2026-11-05T06:15:00+00:00","data":[{"details":{"new":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","old":null},"type":"description"},{"details":{"new":"EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute","old":null},"type":"title"},{"details":{"added":["https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7/"],"removed":[]},"type":"references"}],"id":"5b77a071-81ac-4581-9b66-f8fd3b6b8a0a"},{"created":"2026-11-05T08:30:00+00:00","data":[{"details":{"added":["CWE-79"],"removed":[]},"type":"weaknesses"}],"id":"10df753a-b821-4db0-9813-b4f80e3946b1"}],"cpes":{"data":[],"providers":[]},"created":{"data":"2026-11-05T06:00:27.687000+00:00","provider":"mitre"},"description":{"data":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{},"provider":null},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{},"provider":null},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":null,"provider":null}},"references":{"data":["https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7/"],"providers":["mitre","nvd"]},"title":{"data":"EWWW Image Optimizer 8.7.4 - 8.9.0 - Author+ Stored XSS via 'data-script' Lazy Load Attribute","provider":"mitre"},"updated":{"data":"2026-11-05T08:15:17.985324+00:00","provider":"enrichment"},"vendors":{"data":[],"providers":[]},"weaknesses":{"data":["CWE-79"],"providers":["enrichment"]}}}