Unknown Robin Image Optimizer vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Robin Image Optimizer, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.5CVE-2026-89193unknownrobin image optimizer+1
EPSS score
0.22%
The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.4.3CVE-2026-89190unknownrobin image optimizer+1
EPSS score
0.16%
The Robin Image Optimizer WordPress plugin before 2.0.8 does not check the user's capabilities before dispatching one of its bundled admin framework's request handlers, allowing users with a subscriber-level account to render admin-only Robin Image Optimizer WordPress plugin before 2.0.8 pages and disclose the Robin Image Optimizer WordPress plugin before 2.0.8's stored settings.