CVE-2026-84773: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in 作者: Shane Bishop EWWW Image Optimizer

This vulnerability, identified as CWE-79, affects EWWW Image Optimizer versions <= 8.7.6 and involves improper neutralization of input during web page generation, leading to unauthenticated cross-site scripting (XSS). The CVSS 3.1 base score is 7.2, indicating a high impact with network attack vector, low attack complexity, no privileges required, no user interaction, and scope change. The vulnerability can result in limited confidentiality and integrity impact but no availability impact. There are no known exploits in the wild and no vendor-provided patch or remediation at this time.

Successful exploitation could allow an unauthenticated attacker to execute arbitrary scripts in the context of the affected web application, potentially leading to limited disclosure of sensitive information and modification of data. There is no indication of availability impact. The scope is changed, meaning the vulnerability affects resources beyond the vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider applying web application firewall (WAF) rules to detect and block XSS payloads targeting this plugin. Monitor official vendor channels for updates.