TLP:CLEAR confidence:low August 19, 2026 · #cyber-news #CVE-2026-15446 #CVE-2026-15780 #high

CVE-2026-15446 | nosilver4u EWWW Image Optimizer Plugin bis 8.7.3 auf WordPress Unveilhooks

Luke Johnson / Cyber Research US

Summary

Public VulDB listings describe two WordPress plugin cross-site scripting issues: CVE-2026-15780 in Veronalabs WP Statistics through 14.16.8 (REST hit endpoint, utm_campaign) and CVE-2026-15446 in nosilver4u EWWW Image Optimizer through 8.7.3 (Unveilhooks Addon, data-script). Both are rated as remotely triggerable; VulDB states no exploit is available. This memo is a synthesis of those public listings only (plus three same-feed WordPress plugin records that lack a usable vector). No independent reverse engineering or lab confirmation.

Attack vector

CVE-2026-15780: unauthenticated-looking remote HTTP to the plugin REST route /wp-statistics/v2/hit, by supplying attacker-controlled data in the utm_campaign argument (scip VulDB). Typical WordPress REST exposure is over the site’s HTTP(S) surface; auth and CSRF preconditions are not stated.

CVE-2026-15446: network-reachable manipulation of the data-script argument on the Unveilhooks Addon of EWWW Image Optimizer ≤ 8.7.3 (scip VulDB). How that argument is submitted (admin UI, frontend markup, AJAX) and whether the caller must be authenticated are not stated.

Exploit

Both issues are classified as cross-site scripting from unsanitized argument handling. VulDB gives no stored-vs-reflected distinction, no sink (e.g. HTML attribute vs. script context), no sanitization bypass, no payload, and no tooling. It explicitly says no exploit is available for either CVE. No privilege-escalation or auth-bypass chain is described for these two IDs.

In the wild / novelty

Disclosure-only VulDB catalog entries. No public PoC, no honeypot hits, and no confirmed victim exploitation are stated. “Kein Exploit verfügbar” / “no exploit available” is repeated for both hinted CVEs and for the other plugins in this feed batch.

Risk

Successful XSS in a WordPress admin or visitor context can steal session cookies, perform actions as the victim, or inject further content on sites running the affected plugin versions. Blast radius is per-site (WP Statistics analytics hit path is especially likely to be hit by unauthenticated traffic if the REST route is enabled). Identities at risk are whoever renders the reflected/stored value (admins or site visitors); that audience is not specified in the sources.

Remediation

VulDB advises updating the affected component where it comments at all. Practical steps grounded in the listings: upgrade WP Statistics past 14.16.8 and EWWW Image Optimizer past 8.7.3 when vendor builds exist; restrict or monitor POST/GET to /wp-statistics/v2/hit and unexpected utm_campaign values; review Unveilhooks/data-script output for unsanitized script injection. No detection signatures or patch diffs are provided in the articles. Validate by confirming plugin versions and that the named parameters are encoded on output.

CVE / identifiers

CVE-2026-15780 (WP Statistics ≤ 14.16.8, REST /wp-statistics/v2/hit, utm_campaign XSS). CVE-2026-15446 (EWWW Image Optimizer ≤ 8.7.3, Unveilhooks Addon, data-script XSS). Same-batch, not technically tied: CVE-2026-19417 / EUVD-2026-62290 (KiviCare ≤ 4.5.3, privilege increase), CVE-2026-18031 (TabaPay Gateway ≤ 1.4.0, weak authentication), CVE-2026-18202 (JetEngine ≤ 3.8.13, XSS). No CWE IDs stated.

Confidence

low — single-outlet VulDB RSS abstracts, “unknown” functions/data, no vendor advisory text, no PoC, and no exploitation evidence.

Open questions

Whether either XSS is reflected or stored, and whether authentication or a nonce is required. Exact patched versions (only “through” upper bounds are given). How data-script is reached on Unveilhooks. Whether /wp-statistics/v2/hit is intentionally public for analytics. No technical overlap among KiviCare privilege increase, TabaPay weak auth, and JetEngine XSS beyond “WordPress plugin, network, no exploit.”