Threats tagged 'ghsa-3ccr-99wp-7ppp'

The EWWW Image Optimizer WordPress plugin versions before 8.9.1 contain a vulnerability that allows authenticated users with author-level access or higher to inject arbitrary web scripts via post content. This occurs because the plugin does not properly sanitize and restrict certain values before dynamically loading and executing scripts on the page. The issue is a partial regression of CVE-2026-15446, as the origin and path restrictions introduced in versions 8.7.4 through 8.9.0 can be bypassed, leaving these versions vulnerable.