Live › vulnerability › CVE-2026-97328
Go to dashboardThe WebP Express WordPress plugin before 0.25.16 does not escape values its bundled HTML parser writes into element attributes when a non-default image delivery mode is enabled. An unauthenticated attacker can submit content that is stored and runs as cross-site scripting in the browser of anyone who views an affected page, including administrators.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running WebP Express before 0.25.16 with a non-default image delivery mode enabled are exposed, since the flaw sits in the HTML attribute handling on that path. Sites on the default delivery mode, or without the plugin, are not described as affected by the sources. Administrators viewing affected pages are the highest-value targets.
No product ranges from the sources yet.
wp plugin get webp-express --field=version0.25.16 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
This page as .md · .json · in your agent: get_signal("CVE-2026-97328")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.