CVE-2026-92826 is a reflected cross-site scripting vulnerability in the EWWW Image Optimizer WordPress plugin (nosilver4u) affecting all versions up to and including 8.7.7. The flaw exists due to improper neutralization of input in the REQUEST_URI parameter key, which is insufficiently sanitized and escaped before being included in web page generation. This allows unauthenticated attackers to inject malicious scripts that execute in the context of users who interact with crafted links, but only if the 'enable_help' option is enabled, as the vulnerable HelpScout Beacon script block is conditionally emitted.

An attacker can inject arbitrary web scripts that execute in the victim's browser, potentially leading to information disclosure or session hijacking. The vulnerability requires user interaction (clicking a crafted link) and the 'enable_help' option to be active. There is no indication of privilege escalation or denial of service. The CVSS 3.1 base score is 6.1 (medium), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

No official patch or fix is currently documented. Users should verify the status of the 'enable_help' option and consider disabling it to prevent the vulnerable script block from being emitted. Monitor vendor advisories for updates or patches addressing this vulnerability. Until a fix is available, restricting or sanitizing inputs related to REQUEST_URI parameters may reduce risk.