ghsa-3ccr-99wp-7ppp

{
  "affected": [],
  "aliases": [
    "CVE-2026-91049"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-11-05T06:17:10Z",
    "severity": null
  },
  "details": "The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content before using it to dynamically load and execute a script in the page, allowing authenticated attackers with author-level access and above to inject arbitrary web scripts that run in the session of any user who views the affected page, including administrators.\n\nThis is an incomplete fix of CVE-2026-15446: the origin and path restrictions added from 8.7.4 onward were each bypassable, so versions 8.7.4 through 8.9.0 remain affected.",
  "id": "GHSA-3ccr-99wp-7ppp",
  "modified": "2026-11-05T06:34:38Z",
  "published": "2026-11-05T06:34:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-91049"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/cdaf3779-3e8a-4997-9868-707bcc06f9a7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}