CVE-2026-15446 is a stored cross-site scripting vulnerability in the nosilver4u EWWW Image Optimizer WordPress plugin affecting all versions up to and including 8.7.3. The flaw arises from improper neutralization of input in the 'data-script' lazy load attribute within post content. Authenticated attackers with contributor-level privileges or higher can embed crafted img elements with class='lazyload' and a malicious 'data-script' attribute. The plugin's bundled lazysizes ls.unveilhooks addon then dynamically creates and inserts a script element pointing to the attacker-controlled URL into the DOM when the page is viewed, enabling script execution in the context of the site.

An attacker with contributor-level access or higher can inject arbitrary JavaScript that executes in the browsers of users who view the compromised post content. This can lead to partial confidentiality and integrity loss of user data (as indicated by the CVSS vector: Confidentiality and Integrity impacts are low, Availability is not affected). The vulnerability does not require user interaction beyond viewing the infected page and can affect all users who access the injected content.

No official patch or fix information is provided in the vendor advisory or input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the EWWW Image Optimizer plugin if possible. Monitor for updates from the vendor regarding a security update addressing this vulnerability.