EWWW Image Optimizer

The EWWW Image Optimizer plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via REQUEST_URI Parameter Key in all versions up to, and including, 8.7.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation requires that the enable_help option is active, as the vulnerable HelpScout Beacon script block is only emitted when that setting is enabled.

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.7.7. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The EWWW Image Optimizer plugin for WordPress is vulnerable to Arbitrary File Deletion in all versions up to, and including, 8.7.0. This is due to missing upload-directory scope enforcement in the WebP migration file-operation routine, allowing paths outside the current site's uploads folder on multisite. This makes it possible for authenticated attackers, with administrator-level access and above, to rename or delete WebP-derivative image files outside their own site's uploads directory, including files belonging to other sites on a multisite network.

The EWWW Image Optimizer plugin for WordPress is vulnerable to PHP Object Injection in versions 8.6.0 through 8.7.7. This is due to deserialization of untrusted input. This makes it possible for authenticated attackers, with author-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.7.6. This is due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 8.7.6. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The EWWW Image Optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content in all versions up to, and including, 8.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The exploit is achieved by embedding a crafted img element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in post content, which the plugin's bundled lazysizes ls.unveilhooks addon then uses to dynamically create and insert a script element into the DOM at page view time.