PT-2026-121277

CVE-2026-97328

Published

2026-10-22

Updated

2026-10-22

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions WebP Express WordPress plugin versions prior to 0.25.16

Description When a non-default image delivery mode is enabled, the bundled HTML parser fails to escape values re-emitted into element attributes. This allows unauthenticated users to submit content that is stored and subsequently executed as Cross-Site Scripting (XSS) in the browser of any user viewing the affected page, including administrators. Cross-Site Scripting is a technique where malicious scripts are injected into trusted websites.

Recommendations Update WebP Express WordPress plugin to version 0.25.16 or later.

Exploitability

Exploit

Fix

Impacts

Researchers

Jakub Herman

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers