CVE-2026-89193
Last modified
CVE-2026-89193 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators..
Description
The Robin Image Optimizer WordPress plugin before 2.0.8 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
Metrics
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Robin Image Optimizer | >= 2.0.0, < 2.0.8 |
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-89193?
How severe is CVE-2026-89193?
How do I fix CVE-2026-89193?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-89180EFence developed by Thinking Software Technology has a SQL I…7.5
- CVE-2026-89182With `[repository] FORCE_PRIVATE = true`, Gitea creates new …5.4
- CVE-2026-89186Use of Cache Containing Sensitive Information in ZenHive mpp…6.3
- CVE-2026-8919Permissive Cross-domain Security Policy with Untrusted Domai…7.2
- CVE-2026-89190The Robin Image Optimizer WordPress plugin before 2.0.8 doe…4.3
- CVE-2026-89191Unsanitised input in the "template name" field of SQLView KR…6.8
- CVE-2026-89195The Site Setup Wizard WordPress plugin through 1.5.8 does no…8.6
- CVE-2026-89196A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
- CVE-2026-89197A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
- CVE-2026-89198A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
- CVE-2026-89199A vulnerability has been identified in RUGGEDCOM CROSSBOW (A…8.8
- CVE-2026-8920Improper Restriction of Communication Channel to Intended En…8.5
Are you affected by CVE-2026-89193?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST