{"affected":[],"aliases":["CVE-2026-91049"],"database_specific":{"cwe_ids":[],"github_reviewed":false,"github_reviewed_at":null,"nvd_published_at":"2026-11-05T06:17:10Z","severity":null},"details":"The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.","id":"GHSA-3ccr-99wp-7ppp","modified":"2026-11-05T06:34:38Z","published":"2026-11-05T06:34:38Z","references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-91049"},{"type":"WEB","url":"https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7"}],"schema_version":"1.4.0","severity":[]}