PLUGIN SECURITY
Is Ewww Image Optimizer safe?
Comprehensive image optimization with WebP, AVIF, Lazy Load, and more. Optimize images automatically for Faster Sites and Happy Visitors.
What this plugin does
- Slug:
ewww-image-optimizer - Author: Shane Bishop
- 1000000+ active installs
- 96/100 rating (1842 reviews on wordpress.org)
- 50850001 all-time downloads
- On WordPress.org since 2012-06-07
compressconvertlazy loadresizewebp
Maintenance status
- Latest known version: 8.7.5
- Last updated: 2026-10-13 5:11pm GMT
- Tested up to WordPress: 7.1.4
- Requires PHP: 7.4+
Known vulnerabilities
13 known CVEs on file for Ewww Image Optimizer. Reported between 2014 and 2026.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-92826 | EWWW Image Optimizer [ewww-image-optimizer] < 8.8.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 8.8.0 | 8.8.0 | 2026-09-30 | ⚠ update needed |
| CVE-2026-91072 | EWWW Image Optimizer [ewww-image-optimizer] < 8.8.0 | External Control of File Name or Path | Unknown | < 8.8.0 | 8.8.0 | 2026-09-30 | ⚠ update needed |
| CVE-2026-91051 | EWWW Image Optimizer [ewww-image-optimizer] >= 8.6.0 - < 8.8.0 | Deserialization of Untrusted Data | Unknown | 8.6.0–8.8.0 | 8.8.0 | 2026-09-30 | ⚠ update needed |
| CVE-2026-97067 | EWWW Image Optimizer [ewww-image-optimizer] < 8.8.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.5 | < 8.8.0 | 8.8.0 | 2026-09-15 | ⚠ update needed |
| CVE-2026-91011 | EWWW Image Optimizer [ewww-image-optimizer] < 8.7.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 8.7.7 | 8.7.7 | 2026-09-02 | ⚠ update needed |
| CVE-2026-84773 | EWWW Image Optimizer [ewww-image-optimizer] < 8.7.7 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.2 | < 8.7.7 | 8.7.7 | 2026-08-18 | ⚠ update needed |
| CVE-2024-31924 | EWWW Image Optimizer [ewww-image-optimizer] < 7.3.0 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 7.3.0 | 7.3.0 | 2024-04-10 | ✓ fixed in latest |
| CVE-2026-15446 | EWWW Image Optimizer [ewww-image-optimizer] < 8.7.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 8.7.4 | 8.7.4 | 2024-04-10 | ✓ fixed in latest |
+ 11 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2023-40600 | EWWW Image Optimizer [ewww-image-optimizer] < 7.2.1 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 7.2.1 | 7.2.1 | 2023-11-14 | ✓ fixed in latest |
| — | EWWW Image Optimizer [ewww-image-optimizer] < 7.2.1 | — | Unknown | < 7.2.1 | 7.2.1 | 2023-09-08 | ✓ fixed in latest |
| CVE-2021-4342 | EWWW Image Optimizer [ewww-image-optimizer] < 5.9 | — | Unknown | < 5.9 | 5.9 | 2023-06-07 | ✓ fixed in latest |
| — | EWWW Image Optimizer [ewww-image-optimizer] < 5.8.2 | — | Unknown | < 5.8.2 | 5.8.2 | 2020-09-16 | ✓ fixed in latest |
| CVE-2020-36750 | EWWW Image Optimizer [ewww-image-optimizer] < 5.9 | Cross-Site Request Forgery (CSRF) | Medium 4.3 | < 5.9 | 5.9 | 2020-09-06 | ✓ fixed in latest |
| — | EWWW Image Optimizer [ewww-image-optimizer] < 2.8.4 | — | Unknown | < 2.8.4 | 2.8.4 | 2016-06-09 | ✓ fixed in latest |
| CVE-2016-20010 | EWWW Image Optimizer [ewww-image-optimizer] < 2.8.5 | — | Critical 10.0 | < 2.8.5 | 2.8.5 | 2016-06-08 | ✓ fixed in latest |
| CVE-2014-6243 | EWWW Image Optimizer [ewww-image-optimizer] < 2.0.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 2.0.2 | 2.0.2 | 2014-09-04 | ✓ fixed in latest |
| — | EWWW Image Optimizer [ewww-image-optimizer] < 5.9 | — | Unknown | < 5.9 | 5.9 | — | ✓ fixed in latest |
| — | EWWW Image Optimizer [ewww-image-optimizer] < 7.2.1 | — | Unknown | < 7.2.1 | 7.2.1 | — | ✓ fixed in latest |
| — | EWWW Image Optimizer < 7.2.1 - Sensitive Information Exposure | — | Unknown | < 7.2.1 | 7.2.1 | — | ✓ fixed in latest |
How to fix it
Keep Ewww Image Optimizer updated — 8.7.5 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Minify HTML — 10000+ active installs — 94/100 (33) — max PHP 8.4
- Cimo – Free Instant Image Optimizer & WebP Converter — 10000+ active installs — 98/100 (20) — max PHP 8.4
- ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization — 10000+ active installs — 96/100 (145) — max PHP 8.4
- PNG to JPG — 10000+ active installs — 94/100 (40)
- Images to WebP — 9000+ active installs — 88/100 (32)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.