Plugin icon

EWWW Image Optimizer

ewww-image-optimizer

Vulnerabilities:

13

Last Updated:

October 13, 2026

Active Installs:

1000000

Published
Title
Fixed in
CVSS
Published
2026-10-02
Title
EWWW Image Optimizer < 8.8.0 - Reflected XSS via REQUEST_URI Parameter Key
Fixed in
Fixed in 8.8.0
CVSS
4.7 (medium)
Published
2026-09-30
Title
EWWW Image Optimizer < 8.8.0 - Contributor+ Stored XSS
Fixed in
Fixed in 8.8.0
CVSS
5.5 (medium)
Published
2026-09-28
Title
EWWW Image Optimizer < 8.8.0 - Admin+ WebP File Rename and Deletion via Unrestricted Path in WebP Migration Handler
Fixed in
Fixed in 8.8.0
CVSS
4.4 (medium)
Published
2026-09-28
Title
EWWW Image Optimizer 8.6.0 - 8.7.7 - Author+ PHP Object Injection via 'eio_page_settings' Post Meta
Fixed in
Fixed in 8.8.0
CVSS
6.6 (medium)
Published
2026-09-15
Title
EWWW Image Optimizer < 8.7.7 - Author+ Stored XSS via Image Class Attribute Backreference Expansion
Fixed in
Fixed in 8.7.7
CVSS
6.8 (medium)
Published
2026-09-02
Title
EWWW Image Optimizer < 8.7.7 - Unauthenticated Stored XSS
Fixed in
Fixed in 8.7.7
CVSS
7.2 (high)
Published
2026-08-18
Title
EWWW Image Optimizer < 8.7.4 - Contributor+ Stored XSS via 'data-script' Lazy Load Attribute in Post Content
Fixed in
Fixed in 8.7.4
CVSS
5.5 (medium)
Published
2024-04-10
Title
EWWW Image Optimizer < 7.3.0 - Cross-Site Request Forgery
Fixed in
Fixed in 7.3.0
CVSS
4.3 (medium)
Published
2023-11-14
Title
EWWW Image Optimizer < 7.2.1 - Unauthenticated Sensitive Information Exposure via Debug Log
Fixed in
Fixed in 7.2.1
CVSS
5.3 (medium)
Published
2023-09-08
Title
EWWW Image Optimizer < 7.2.1 - Sensitive Information Exposure
Fixed in
Fixed in 7.2.1
CVSS
5.3 (medium)
Published
2020-09-06
Title
EWWW Image Optimizer < 5.9 - Cross-Site Request Forgery
Fixed in
Fixed in 5.9
CVSS
4.3 (medium)
Published
2016-06-09
Title
EWWW Image Optimizer <= 2.8.3 - Remote Code Execution
Fixed in
Fixed in 2.8.4
CVSS
n/a
Published
2014-10-09
Title
EWWW Image Optimizer 2.0.1 - Cross-Site Scripting (XSS)
Fixed in
Fixed in 2.0.2
CVSS
n/a