CVE-2026-97328: WebP Express 0 to before 0.25.16

Affected technology

WebP Express · 0 to before 0.25.16
Vendor not specified by the source

Description’s affected range: before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

The source says the WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators. Source advisory’s CVSS 3.1 assessment (base score 7.5/10) rates confidentiality, integrity and availability impact as high.