Skip to content
PluginCanary

EWWW Image Optimizer

by Shane Bishop · 1,000,000+ active installs · Checked 4 Nov 2026
Watch

Watch: held back by a low Support score (17 of 100).

75/ 100 Canary Score
Sub-scores for EWWW Image Optimizer
Ownership100
Maintenance100
Security60
Support17
Reputation85

How the score works

Quick answers

Is EWWW Image Optimizer still maintained?
Yes. Last release 29 Oct 2026, 25 releases in the last 24 months. 29 Oct 2026 · wordpress.org
Who owns EWWW Image Optimizer, and has it changed hands?
No change recorded. Main committer nosilver4u since Jun 2012. 4 Nov 2026 · SVN log
Was EWWW Image Optimizer removed from wordpress.org?
No. Listed on wordpress.org as of 4 Nov 2026. 4 Nov 2026 · wordpress.org
Is EWWW Image Optimizer safe?
13 known vulnerabilities, all fixed (latest in 8.8.0). Not on the exploited list. 2 Oct 2026 · Wordfence Intelligence
Is the latest EWWW Image Optimizer update safe to install?
No ownership change before 8.9.1. No one-star spike after it. 29 Oct 2026 · Release history

Active signals

Facts we detected, with links to the source.

No open risk signals. Signals appear here when we detect an ownership change, closure, vulnerability or decline.

Ownership timeline

Who commits to the plugin's code on wordpress.org, over time.

Committers and their active periods
nosilver4u7 Jun 2012 to 29 Oct 2026, 1147 commits

1 committer recorded. No ownership change since 2012.

Maintenance

Last release
5 days ago
Releases, 24 months
25
Tested up to
7.1 current
Requires PHP
7.4 supported 8.2+
Releases per quarter
Releases per quarter for EWWW Image Optimizer
Q1 20244
Q2 20242
Q3 20242
Q4 20242
Q1 20254
Q2 20251
Q3 20252
Q4 20252
Q1 20262
Q2 20265
Q3 20266
Q4 20262

Last release 29 Oct 2026. Tested with WordPress 7.1 (current).

Reputation

Last 90 days: 5.0 (8 reviews). Lifetime: 4.8.

Average rating per quarter for EWWW Image Optimizer
Q1 20264.5
Q2 20265.0
Q3 20265.0
Q4 20265.0

Average rating rose from 4.5 to 5.0 between Q1 2026 and Q4 2026.

Rating distribution
5 star1668
4 star71
3 star18
2 star14
1 star73
Latest low reviews

Security record

7 vulnerabilities in 24 months (13 on record), all patched (latest fixed in 8.8.0).

Show 13 patched vulnerabilities
PublishedIssueCVSSAffectedFixed inDays to patch
2 Oct 2026EWWW Image Optimizer <= 8.7.7 - Reflected Cross-Site Scripting via REQUEST_URI Parameter Key6.1<= 8.7.78.8.0Patched before disclosure
30 Sep 2026EWWW Image Optimizer <= 8.7.7 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4<= 8.7.78.8.0Patched before disclosure
28 Sep 2026EWWW Image Optimizer <= 8.7.0 - Authenticated (Administrator+) Cross-Site WebP File Deletion or Rename4.7<= 8.7.08.8.0Patched before disclosure
28 Sep 2026EWWW Image Optimizer 8.6.0 - 8.7.7 - Authenticated (Author+) PHP Object Injection7.58.6.0 to 8.7.78.8.0Patched before disclosure
15 Sep 2026EWWW Image Optimizer <= 8.7.6 - Authenticated (Author+) Stored Cross-Site Scripting6.4<= 8.7.68.7.7Patched before disclosure
2 Sep 2026EWWW Image Optimizer <= 8.7.6 - Unauthenticated Stored Cross-Site Scripting7.2<= 8.7.68.7.7Patched before disclosure
18 Aug 2026EWWW Image Optimizer <= 8.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-script' Lazy Load Attribute in Post Content6.4<= 8.7.38.7.4Patched before disclosure
10 Apr 2024EWWW Image Optimizer <= 7.2.3 - Cross-Site Request Forgery4.3<= 7.2.37.3.0Patched before disclosure
14 Nov 2023EWWW Image Optimizer <= 7.2.0 - Unauthenticated Sensitive Information Exposure via Debug Log5.3<= 7.2.07.2.1Patched before disclosure
8 Sep 2023EWWW Image Optimizer <= 7.2.0 - Sensitive Information Exposure5.3< 7.2.17.2.1Patched before disclosure
6 Sep 2020EWWW Image Optimizer <= 5.8.1 - Cross-Site Request Forgery Bypass4.3<= 5.8.15.9n/a
8 Jun 2016EWWW Image Optimizer <= 2.8.4 - Remote Code Execution9.6<= 2.8.42.8.5358
9 Oct 2014EWWW Image Optimizer <= 2.0.1 - Reflected Cross-Site Scripting6.1<= 2.0.12.0.2695

Changelog mentions of security fixes: 8.7.7 (security, XSS, escaping); 8.8.0 (security, XSS); 8.9.0 (security, XSS); 8.9.1 (security).

Sources: Wordfence Intelligence, CISA Known Exploited Vulnerabilities, readme changelogs.

Support

17% of 6 support threads resolved in the last 2 months.

Momentum

1,000,000+ active installs. History builds with each weekly snapshot.

Weekly downloads, last 27 weeks
Weekly downloads for EWWW Image Optimizer
4 May 202613,606
11 May 2026331,827
18 May 2026389,283
25 May 2026105,283
1 Jun 2026344,528
8 Jun 2026373,955
15 Jun 202684,962
22 Jun 202648,211
29 Jun 202642,383
6 Jul 2026327,080
13 Jul 2026404,687
20 Jul 202690,884
27 Jul 202650,625
3 Aug 2026369,639
10 Aug 202666,759
17 Aug 2026372,316
24 Aug 2026101,806
31 Aug 2026376,554
7 Sep 202663,425
14 Sep 202661,200
21 Sep 2026347,161
28 Sep 2026101,083
5 Oct 202664,194
12 Oct 2026363,715
19 Oct 2026108,511
26 Oct 2026373,723
2 Nov 202625,799

Weekly downloads over the last 4 weeks are 9% above the 27-week average.

Healthier alternatives

Same job, rated Healthy, higher Canary Score and at least 10,000 installs. Never sponsored.

Modern Image FormatsScore 93 · 100,000+CompressXScore 93 · 40,000+CimoScore 93 · 10,000+Imagify Image OptimizationScore 92 · 900,000+reSmush.itScore 92 · 100,000+

Facts

Version8.9.1
AuthorShane Bishop
Added7 Jun 2012
Last updated29 Oct 2026
Active installs1,000,000+
Requires WordPress6.8
Tested up to7.1.4
Requires PHP7.4
CategoryPerformance & Optimization > Caching Solutions
Tagswebp, resize, convert, compress, lazy load

Other plugins by this author: Imsanity, Force Regenerate Thumbnails, S3 Image Optimizer, Easy Image Optimizer

Questions

Is EWWW Image Optimizer still maintained?

Yes. Last release 29 Oct 2026, 25 releases in the last 24 months.

Who owns EWWW Image Optimizer, and has it changed hands?

No change recorded. Main committer nosilver4u since Jun 2012.

Was EWWW Image Optimizer removed from wordpress.org?

No. Listed on wordpress.org as of 4 Nov 2026.

Is EWWW Image Optimizer safe?

13 known vulnerabilities, all fixed (latest in 8.8.0). Not on the exploited list.

Is the latest EWWW Image Optimizer update safe to install?

No ownership change before 8.9.1. No one-star spike after it.

Data: wordpress.org Plugins API, plugins SVN and Trac, wordpress.org reviews and support forum, Wordfence Intelligence, CISA KEV, NVD.Plugin data refreshed 4 Nov 2026.Report a data issue