CVE-2026-97328 in WebP Express Plugin
Summary
by MITRE • 10/22/2026
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/22/2026
The vulnerability identified in WebP Express WordPress plugin versions prior to 0.25.16 represents a critical server-side input validation failure leading to Stored Cross-Site Scripting. This flaw is rooted in the improper handling of user-supplied data within the plugin's bundled HTML parser, specifically when operating under non-default image delivery modes. The core technical deficiency lies in the lack of proper output encoding or escaping for values that are re-emitted into HTML element attributes. When an attacker submits malicious content through a vector accessible to unauthenticated users, such as comment fields or custom metadata inputs depending on the specific configuration, this data is stored directly within the database without sanitization. Subsequently, when the plugin processes images and reconstructs HTML elements for delivery, it injects these unsanitized values into attribute positions of DOM elements. Because modern browsers parse attributes with less strict context awareness than body content in certain scenarios, particularly when special characters are not escaped, this allows arbitrary JavaScript code to be injected directly into the page structure.
From a technical perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The specific mechanism here involves attribute injection where user input is placed within quotes or unquoted attributes without proper encoding of special characters such as double quotes, single quotes, ampersands, and angle brackets. This allows the attacker to break out of the intended attribute context and inject event handlers like onerror or onload, or manipulate existing tags to execute scripts in the victim's browser session. The impact is severe because it affects all users who view pages containing the affected content, including administrators with elevated privileges. An unauthenticated attacker can persistently store this payload, meaning a single successful injection can compromise every subsequent visitor until the malicious content is manually removed from the database or the plugin is updated.
The operational impact of this vulnerability extends beyond simple script execution to potential account takeover and session hijacking if combined with other vectors like cookie stealing via document.cookie access. Since WordPress administrators often have broad control over site configuration, a successful XSS attack against an admin could allow an attacker to modify theme files, install malicious plugins, or alter user roles, effectively granting full administrative control of the compromised website. This persistence distinguishes it from reflected XSS attacks and makes remediation more complex as cleanup requires not only patching the software but also auditing database entries for previously injected payloads. The vulnerability is particularly dangerous in environments where image optimization services are heavily utilized, as these plugins often process large volumes of user-uploaded content, increasing the attack surface significantly.
Mitigation strategies must prioritize immediate version updates to WebP Express 0.25.16 or later, which addresses this input validation gap by implementing robust escaping mechanisms for all values re-emitted into HTML attributes regardless of the active image delivery mode. In addition to upgrading, administrators should implement strict Content Security Policy headers that restrict script execution sources and prevent inline scripts where possible, although CSP is a defense-in-depth measure rather than a direct fix for this specific code flaw. Input validation at the point of entry remains critical; while the plugin developer must handle output encoding, site owners can enforce stricter input sanitization through additional security plugins or custom functions that strip dangerous characters from user submissions before they reach the database. Regular auditing of stored content and monitoring for anomalous script execution in browser consoles can also help detect exploitation attempts early. Ultimately, this incident underscores the necessity of rigorous OWASP Top 10 compliance checks during plugin development and deployment, ensuring that all dynamic data is treated as untrusted until explicitly validated and encoded for its specific output context.