CVE-2026-97328

HighCVSS 7.5

Published: 22/10/2026(UTC)Updated: 22/10/2026(UTC)Translated: 22/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.22%

11th percentile - higher than 11% of all known CVEs

Summary

The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled. This allows unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.

Risk Assessment

An attacker can store a malicious script that executes in an administrator's or other visitor's browser, potentially leading to session or account takeover. The risk applies to sites with a non-default image delivery mode enabled.

Recommendation

Update the WebP Express plugin to version 0.25.16 or later. Until updated, consider disabling the non-default image delivery mode.

Other vulnerabilities in WebP Express

CVE-2025-11379Medium
The WebP Express plugin for WordPress is vulnerable to information exposure via config files in all versions up to, and including, 0.25.9. This is due to the plugin not properly randomizing the name of the config file to prevent direct access on NGINX. This makes it possible for unauthenticated attackers to extract configuration data.

Original NVD description (English source)

The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS