Unknown Ewww Image Optimizer vulnerabilities

3 CVEs affecting Unknown Ewww Image Optimizer, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-91072, published 2026-09-30.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-91011, published 2026-09-17. Medium severity, CVSS 6.8. EPSS: 0.4% chance of exploitation in the next 30 days. The EWWW Image Optimizer WordPress plugin before 8.7.7 does not properly escape image attribute values when it rewrites page output, allowing authenticated users with author-level access and above to…
CVE-2026-91051, published 2026-09-30. Medium severity, CVSS 6.6. EPSS: 0.4% chance of exploitation in the next 30 days. The EWWW Image Optimizer WordPress plugin before 8.8.0 does not prevent authenticated users with author-level permissions from storing a serialized value in a post meta field that is deserialized…
CVE-2026-91072, published 2026-09-30. Medium severity, CVSS 4.4. EPSS: 0.2% chance of exploitation in the next 30 days. The EWWW Image Optimizer WordPress plugin before 8.8.0 does not confine a WebP-derivative file migration routine to the current site's own uploads directory, letting an attacker with…