Ewww Image Optimizer Vulnerabilities

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

CVSS:

6.1

(Wordfence)

Affected:

up to 8.7.7

Fixed in:

8.8.0

Disclosed:

Oct 2, 2026

CVE-2026-92826 on NVD →

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.7.7. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web...

CVSS:

6.4

(Wordfence)

Affected:

up to 8.7.7

Fixed in:

8.8.0

Disclosed:

Sep 30, 2026

CVE-2026-97067 on NVD →

The EWWW Image Optimizer plugin for WordPress is vulnerable to PHP Object Injection in versions 8.6.0 through 8.7.7. This is due to deserialization of untrusted input. This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. No known POP chain is present in the vul...

CVSS:

7.5

(Wordfence)

Affected:

8.6.0 – 8.7.7

Fixed in:

8.8.0

Disclosed:

Sep 28, 2026

CVE-2026-91051 on NVD →

The EWWW Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 8.7.0. This is due to missing upload-directory scope enforcement in the WebP migration file-operation routine, allowing paths outside the current site's uploads folder on multisite. This makes it...

CVSS:

4.7

(Wordfence)

Affected:

up to 8.7.0

Fixed in:

8.8.0

Disclosed:

Sep 28, 2026

CVE-2026-91072 on NVD →

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.7.6. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scri...

CVSS:

6.4

(Wordfence)

Affected:

up to 8.7.6

Fixed in:

8.7.7

Disclosed:

Sep 15, 2026

CVE-2026-91011 on NVD →

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.7.6. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute when...

CVSS:

7.2

(Wordfence)

Affected:

up to 8.7.6

Fixed in:

8.7.7

Disclosed:

Sep 2, 2026

CVE-2026-84773 on NVD →

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-le...

CVSS:

6.4

(Wordfence)

Affected:

up to 8.7.3

Fixed in:

8.7.4

Disclosed:

Aug 18, 2026

CVE-2026-15446 on NVD →

The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.3. This is due to missing or incorrect nonce validation on the check_for_optin() and check_for_optout() functions. This makes it possible for unauthenticated attackers to opt in and out of...

CVSS:

4.3

(Wordfence)

Affected:

up to 7.2.3

Fixed in:

7.3.0

Disclosed:

Apr 10, 2024

CVE-2024-31924 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in Exactly WWW EWWW Image Optimizer.This issue affects EWWW Image Optimizer: from n/a through 7.2.3.

Affected:

up to 7.3.0

Fixed in:

7.3.0

Disclosed:

Apr 10, 2024

CVE-2024-31924 on NVD →

[en] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Exactly WWW EWWW Image Optimizer. It works only when debug.log is turned on.This issue affects EWWW Image Optimizer: from n/a through 7.2.0.

Affected:

up to 7.2.1

Fixed in:

7.2.1

Disclosed:

Nov 30, 2023

CVE-2023-40600 on NVD →

The EWWW Image Optimizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.2.0 via the debug_log function. This makes it possible for unauthenticated attackers to extract sensitive debug data when debug logging is enabled.

CVSS:

5.3

(Wordfence)

Affected:

up to 7.2.0

Fixed in:

7.2.1

Disclosed:

Nov 14, 2023

CVE-2023-40600 on NVD →

The EWWW Image Optimizer for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.2.0 due to the plugin saving debug logs in predictable locations. This can allow unauthenticated attackers to obtain information about installation paths, file permissions and various plugin settin...

CVSS:

5.3

(Wordfence)

Affected:

up to 7.2.1

Fixed in:

7.2.1

Disclosed:

Sep 8, 2023

The EWWW Image Optimizer for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.2.0 due to the plugin saving debug logs in predictable locations. This can allow unauthenticated attackers to obtain information about installation paths, file permissions and various plugin settin...

Affected:

up to 7.2.1

Fixed in:

7.2.1

Disclosed:

Sep 8, 2023

[en] The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or incorrect nonce validation on the ewww_ngg_bulk_init() function. This makes it possible for unauthenticated attackers to perform bulk image optimization via a...

Affected:

up to 5.9

Fixed in:

5.9

Disclosed:

Jul 12, 2023

CVE-2020-36750 on NVD →

Affected:

up to 5.9

Fixed in:

5.9

Disclosed:

Jun 7, 2023

CVE-2021-4342 on NVD →

[en] EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHP 5.5.

Affected:

up to 2.8.5

Fixed in:

2.8.5

Disclosed:

May 5, 2021

CVE-2016-20010 on NVD →

Cross-Site Request Forgery (CSRF) vulnerability found by Jerome Bruandet (NinTechNet) in WordPress EWWW Image Optimizer plugin (versions <= 5.8.1).

Affected:

up to 5.8.2

Fixed in:

5.8.2

Disclosed:

Sep 16, 2020

The EWWW Image Optimizer plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 5.8.1. This is due to missing or incorrect nonce validation on the ewww_ngg_bulk_init() function. This makes it possible for unauthenticated attackers to perform bulk image optimization via a forg...

CVSS:

4.3

(Wordfence)

Affected:

up to 5.8.1

Fixed in:

5.9

Disclosed:

Sep 6, 2020

CVE-2020-36750 on NVD →

Because of this vulnerability, attackers can create a backdoor or take a site down altogether. Upgrade this plugin.

Affected:

up to 2.8.4

Fixed in:

2.8.4

Disclosed:

Jun 9, 2016

EWWW Image Optimizer before 2.8.5 allows remote command execution because it relies on a protection mechanism involving boolval, which is unavailable before PHP 5.5. Version 2.8.4 provides a partial fix.

CVSS:

9.6

(Wordfence)

Affected:

up to 2.8.4

Fixed in:

2.8.5

Disclosed:

Jun 8, 2016

CVE-2016-20010 on NVD →

[en] Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php, which is not properly handled in a pngout error message...

Affected:

up to 2.0.2

Fixed in:

2.0.2

Disclosed:

Oct 10, 2014

CVE-2014-6243 on NVD →

Cross-site scripting (XSS) vulnerability in the EWWW Image Optimizer plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the error parameter in the ewww-image-optimizer.php page to wp-admin/options-general.php, which is not properly handled in a pngout error message.

CVSS:

6.1

(Wordfence)

Affected:

up to 2.0.1

Fixed in:

2.0.2

Disclosed:

Oct 9, 2014

CVE-2014-6243 on NVD →

The EWWW Image Optimizer for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 7.2.0 due to the plugin saving debug logs in predictable locations. This can allow unauthenticated attackers to obtain information about installation paths, file permissions and various plugin settin...

Affected:

up to 7.2.1

Fixed in:

7.2.1

Over 70 plugins and themes were vulnerable to Cross-Site Request Forgery due to improperly implemented nonce protection that could be bypassed.

Affected:

up to 5.9

Fixed in:

5.9