CVE-2026-97328
WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
| Vendor | unknown |
| Product | webp express |
| Published | Oct 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown webp express
Be the first to know when new unknown vulnerabilities affecting unknown webp express are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / WebP Express
0 < 0.25.16
References
Credits
Jakub Herman WPScan