{"id":"CVE-2026-97328","kind":"vulnerability","aliases":["CVE-2026-97328"],"related":[],"title":"WebP Express WordPress plugin: unescaped HTML attributes enable stored cross-site scripting","description":"The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.","summary":"The WebP Express WordPress plugin before 0.25.16 does not escape values its bundled HTML parser writes into element attributes when a non-default image delivery mode is enabled. An unauthenticated attacker can submit content that is stored and runs as cross-site scripting in the browser of anyone who views an affected page, including administrators.","severity":"high","cvss":7.5,"epss":0.00216,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","self-hosted","wordpress"],"not_affected_if":["default-config","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get webp-express --field=version`\n- Check whether a non-default image delivery mode is enabled in the WebP Express settings (unknown which mode the sources name)","fix":"- Update WebP Express to `0.25.16` or later\n- If an update is not possible, disable the plugin until it is updated","status":"open","published_at":"2026-10-22T06:17:15+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T03:15:14+00:00","updated_at":"2026-10-25T03:15:14+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:15:14Z","model":"claude-haiku-5-5","output":{"fix":"- Update WebP Express to `0.25.16` or later\n- If an update is not possible, disable the plugin until it is updated","reach":"internet","title":"WebP Express WordPress plugin: unescaped HTML attributes enable stored cross-site scripting","impact":"high","summary":"The WebP Express WordPress plugin before 0.25.16 does not escape values its bundled HTML parser writes into element attributes when a non-default image delivery mode is enabled. An unauthenticated attacker can submit content that is stored and runs as cross-site scripting in the browser of anyone who views an affected page, including administrators.","category":"package","nicknames":[],"who_cares":["wordpress","php","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker runs scripts in admin browsers, stealing sessions and taking over the site.","analyst_note":"Confirm which non-default image delivery mode triggers the flaw and the exact check for it, from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-97328.","how_to_check":"- Check the installed plugin version in the WordPress admin Plugins screen or with `wp plugin get webp-express --field=version`\n- Check whether a non-default image delivery mode is enabled in the WebP Express settings (unknown which mode the sources name)","needs_analyst":true,"not_affected_if":["default-config","plugin-not-installed"],"who_is_affected":"Sites running WebP Express before `0.25.16` with a non-default image delivery mode enabled are exposed, since the flaw sits in the HTML attribute handling on that path. Sites on the default delivery mode, or without the plugin, are not described as affected by the sources. Administrators viewing affected pages are the highest-value targets.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000662,"input_tokens":3375,"output_tokens":649,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-97328':16A,19A '0.25.16':32B,89C 'administr':82B,143C 'affect':79B,140C 'allow':115C 'anyon':75B 'attack':57B 'attribut':7A,44B,104C 'browser':73B,134C 'bundl':38B,96C 'content':60B,120C 'cross':11A,68B,129C 'cross-sit':10A,67B,128C 'cve':14A,17A 'default':49B,109C 'deliveri':51B,111C 'element':43B,103C 'emit':101C 'enabl':8A,54B,114C 'escap':35B,92C 'execut':126C 'express':2A,28B,85C 'host':24B 'html':6A,39B,97C 'imag':50B,110C 'includ':81B,142C 'later':125C 'mode':52B,112C 'non':48B,108C 'non-default':47B,107C 'packag':20B 'page':80B,141C 'parser':40B,98C 'php':21B 'plugin':4A,30B,87C 're':100C 're-emit':99C 'run':65B 'script':13A,70B,131C 'self':23B 'self-host':22B 'site':12A,69B,130C 'store':9A,63B,123C 'submit':59B,119C 'unauthent':56B,116C 'unescap':5A 'user':117C,137C 'valu':36B,93C 'view':77B,138C 'webp':1A,27B,84C 'wordpress':3A,25B,29B,86C 'write':41B","nicknames":[],"mitigations":[],"who_affected":"Sites running WebP Express before `0.25.16` with a non-default image delivery mode enabled are exposed, since the flaw sits in the HTML attribute handling on that path. Sites on the default delivery mode, or without the plugin, are not described as affected by the sources. Administrators viewing affected pages are the highest-value targets.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T06:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-97328","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97328","severity":null,"published_at":"2026-10-22T06:17:15+00:00","modified_at":"2026-10-22T15:16:14+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-97328","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-97328","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}