CVE-2026-97328: WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WebP Express WordPress pluginto a version that resolves this vulnerability.Fixed in 0.25.16
Event History
Frequently Asked Questions
Which installations are affected?
Installations using WebP Express versions before 0.25.16 are affected when a non-default image delivery mode is enabled. The issue is not described as affecting the default image delivery mode.
Does exploitation require an authenticated WordPress account?
No. An unauthenticated attacker can submit content that is stored and later executes as script when an affected page is viewed.
What is the impact if an administrator views injected content?
The stored script can execute in the browser of any user viewing the affected page, including WordPress administrators. This makes administrator exposure possible without the attacker needing an account.
What can be done while patching is delayed?
Configure the plugin away from the non-default image delivery mode, since that mode is a stated condition for exploitation. Upgrade to version 0.25.16 or later when possible.