# CVE-2026-15446 - EWWW Image Optimizer <= 8.7.3 WordPress plugin stored XSS. A
# contributor-or-above author embeds an <img class="lazyload" data-script="//attacker/..">
# element in post content; the bundled lazysizes ls.unveilhooks addon creates a <script>
# from data-script at view time. Matches the authenticated content-save POST carrying the
# lazyload + data-script attribute pair (stored XSS -> network detection only).
alert http $EXTERNAL_NET any -> $HTTP_SERVERS $HTTP_PORTS (msg:"VEDAS CVE-2026-15446 EWWW Image Optimizer - Stored XSS via data-script Lazy Load attribute"; flow:established,to_server; http.request_body; content:"lazyload"; nocase; content:"data-script"; nocase; fast_pattern; classtype:web-application-attack; reference:cve,CVE-2026-15446; reference:url,https://www.exploit.observer/?keyword=CVE-2026-15446&match=exact; reference:url,https://subdomain.center/?engine=ammonites&keyword=ewww-image-optimizer&match=exact; sid:1101401; rev:1;)