CVE-2026-97328— WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
Quick assessment
Affected
Unknown WebP Express
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
WebP Express WordPress 插件在 0.25.16 版本之前，当启用非默认的图片交付模式时，未对其捆绑的 HTML 解析器重新输出到元素属性中的值进行转义。这使得未经认证的攻击者能够提交内容，该内容将被存储，并在任何查看受影响页面的用户（包括管理员）的浏览器中作为跨站脚本（XSS）执行。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-97328
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
Source: CVE Program / CVE List V5
Vulnerability Description
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | WebP Express | 0 ~ 0.25.16 | - |
|
II. Public POCs for CVE-2026-97328
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-97328
请登录查看更多情报信息。
Other References for CVE-2026-97328 (1)
-
https://wpscan.com/vulnerability/f44cb329-fb2e-4fb1-b878-8b52b0c769cc/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-10-22 · 13 CVEs total
| CVE-2026-88849 | MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Stude | |
| CVE-2026-111971 | Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Name | |
| CVE-2026-111972 | Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR | |
| CVE-2026-111958 | Royal MCP < 1.5.7 - Authentication Bypass via Preview Link Token | |
| CVE-2026-78392 | Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_target' Parameter | |
| CVE-2026-110011 | MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definitio | |
| CVE-2026-110010 | MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset v | |
| CVE-2026-103234 | WP Ultimate Review < 2.4.5 - Unauthenticated Arbitrary Shortcode Execution via Reviewer Em | |
| CVE-2026-100142 | FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR | |
| CVE-2026-109931 | Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update | |
| CVE-2026-109927 | CM HIPAA Forms < 3.3.2 - hipaa_forms+ Privilege Escalation via cm_hipaa_update_user_role | |
| CVE-2026-109987 | PixelYourSite (Free & Pro) - Unauthenticated Stored XSS via Cookie |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-88849
MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User -
CVE-2026-111971
Photo Engine < 6.5.8 - Author+ Stored XSS via Collection Nam -
CVE-2026-111972
Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion -
CVE-2026-111958
Royal MCP < 1.5.7 - Authentication Bypass via Preview Link T -
CVE-2026-78392
Link Library < 7.9.6 - Contributor+ Stored XSS via 'link_tar
V. Comments for CVE-2026-97328
No comments yet