WebP Express CVE-2026-97328

Exploitation requires that a NON-DEFAULT image delivery mode be enabled in WebP Express (the description ties the flaw to this configuration); on default installs the vulnerable code path is not reached. The flaw is that the plugin's bundled HTML parser re-emits submitted values into element attributes without escaping, so an attacker-controlled value breaks out of the attribute context. Submission does not require authentication (PR:N). The payload is stored and only fires when a user - potentially an administrator - subsequently views the affected page (UI:R), so a viewing victim is a mandatory limiting condition. Limiting factors: non-default configuration must be active, a victim must load the page, and CVSS marks AC:H (conditions beyond the attacker's control). The precise characters/trigger the parser mishandles are not detailed in the available sources.

Signals point to a real but not emergency-level issue. The reporter-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, score 7.5) rates confidentiality, integrity and availability all High, which is unusually aggressive for a stored XSS (CWE-79); for browser-executed script the realistic impact and scope handling are debatable, so treat the 7.5 as a ceiling rather than a confirmed severity. Mitigating factors are material: AC:H plus the stated prerequisite that a non-default image delivery mode be enabled, plus UI:R (a victim must view an affected page), all reduce the practical attack surface, even though PR:N allows the malicious content to be submitted without authentication. KEV: not listed, so there is no confirmed active exploitation. EPSS: not provided in the input, so probabilistic exploitation likelihood cannot be stated. POC: a WPScan reference exists but is not verified as working exploit code. The vuln.today decision label is 'this_week', consistent with a patch-promptly posture rather than an act-now emergency. Net: a genuine, patch-this-week web-application vulnerability whose real-world risk is gated by the non-default configuration requirement and user interaction, not a widespread drive-by threat on default installs.

On a site running WebP Express before 0.25.16 with a non-default image delivery mode enabled, an unauthenticated attacker submits crafted content containing attribute-breaking characters that the plugin's bundled HTML parser re-emits into element attributes without escaping. The payload is stored and later rendered, executing as script in the browser of any visitor who views the affected page - including a logged-in administrator, enabling session/admin-context actions. A public PoC reference exists (WPScan); it is not verified as working exploit code.