Published October 23, 2026. Based on public CVE records available on that date; details may change.
CVE-2026-97328 is a stored cross-site scripting (XSS) flaw in WebP Express versions before 0.25.16. It applies only when the plugin's Alter HTML feature, a non-default way of delivering WebP images, is enabled, and it can be triggered by visitors who are not logged in. Update WebP Express to 0.25.16, then check whether Alter HTML is on and review content submitted by visitors.
What happened
WebP Express can deliver WebP images in two broad ways. It can redirect image requests on the server, or it can rewrite the page HTML so that image tags point to WebP versions. The second approach is the plugin's Alter HTML feature, which uses a bundled HTML parser to read the page and write the image markup back out.
According to the CVE record, that parser did not escape values it re-emits into element attributes. The record says this happens "when a non-default image delivery mode is enabled", and the record's title names the issue as "Unauthenticated Stored XSS via Alter HTML Parser". In plain terms: if Alter HTML is on, content that a visitor submits can be stored on the site and later turned into working script when the plugin rewrites the page.
That script runs in the browser of anyone who views the affected page, including administrators. Script running in a logged-in administrator's browser can act with that administrator's permissions, which is why stored XSS on a WordPress site is treated seriously. The record does not specify which kind of visitor-submitted content carries the payload, so this article does not guess.
The vendor's changelog for 0.25.16, released October 18, 2026, says it fixed a vulnerability in the DOM parser library used for altering HTML. The same entry mentions a separate fix for the plugin's optional web service, which could be used without an API key through crafted inputs. The CVE record reviewed here covers the HTML parser issue only.
Severity and exploitation status
The CVE record carries a CVSS 3.1 base score of 7.5 (High), added by CISA's ADP enrichment, with the vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. That breaks down as network access, high attack complexity, no privileges required, and user interaction required (someone has to view the page).
CISA's SSVC entry in the same record, dated October 22, 2026, lists exploitation as "none" and automatable as "no". The records reviewed for this article do not mention exploitation in the wild.
Who is affected
Every WebP Express version before 0.25.16 is listed as affected, and 0.25.16 is the fixed version. WebP Express has 300,000+ active installations on WordPress.org as of October 23, 2026.
The exposure depends on configuration. Based on the record, sites that use WebP Express only with server redirection, and have never enabled Alter HTML, are outside the described scenario. Sites that turned on Alter HTML, which the plugin's own FAQ suggests for setups such as NGINX without redirection rules or CDN-friendly configurations, are the ones to look at first.
How to check your site
Check the version first. In the WordPress dashboard, open Plugins and find WebP Express. With WP-CLI, run wp plugin list --name=webp-express from the WordPress directory.
Then check the delivery settings:
- Open the WebP Express settings page in the dashboard.
- Find the Alter HTML section and note whether it is enabled, and which replacement option is selected.
- Write this down for your records, including the date, before you change anything.
If Alter HTML was enabled on an affected version, review recent content that visitors can submit, such as comments and form entries that are shown on the site. Look for unusual markup, unexpected attributes, or text that looks like code. Also check for symptoms of script running in an admin's browser: new administrator accounts, changed plugin or theme files, or settings you did not change. Our guides on signs a WordPress site is hacked and finding hidden admin users cover what to look for.
What to do now
Update WebP Express to 0.25.16 or later through Dashboard, Updates, the Plugins screen, or wp plugin update webp-express. This is the main fix, and it also picks up the web service change noted in the changelog.
If you cannot update right away and Alter HTML is enabled, consider turning Alter HTML off until you can. Your images will still work; browsers will receive the original JPEG or PNG files unless server redirection is set up.
After updating:
- Clear your page cache and any CDN cache, so pages rendered before the fix are rebuilt.
- Review administrator accounts and remove any you cannot account for.
- If you find signs of tampering, preserve a backup first, then follow a structured cleanup. Our guide on how to fix a hacked WordPress site lays out the order of steps.
When to get help
Get help if Alter HTML was enabled on an affected version and you find unexplained admin accounts, changed files, or odd markup in submitted content. WordPress malware removal is the place to start for a suspected compromise, and a security audit can review plugin configuration and user access on a site that looks clean.