Summary
A Stored Cross-Site Scripting (XSS) vulnerability exists in the WebP Express plugin for WordPress. This affects all versions of the plugin up to and including 0.25.15. A fix is available in version 0.25.16. There is no evidence of active exploitation.
Affected and patched versions
WebP Express (plugin webp-express): affected 0.25.15 and earlier; fixed in 0.25.16
Is my site vulnerable?
To determine if your WordPress site uses a vulnerable version of the WebP Express plugin, you can check the installed plugin version through your WordPress administration dashboard.
Follow these steps:
Log in to your WordPress administration area.
In the left-hand navigation menu, select "Plugins," then click on "Installed Plugins."
Scroll through the list of installed plugins to locate "WebP Express."
Note the version number displayed next to the plugin name.
If the version number is 0.25.15 or any earlier release, your site is exposed to this vulnerability. Version 0.25.16 and subsequent releases include the necessary fix. If your site runs an affected version, updating the plugin is recommended.
What an attacker actually does
The WebP Express plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability, identified as CVE-2026-97328. This issue stems from insufficient input sanitization and output escaping within the plugin's code. Specifically, when a non-default image delivery mode is active, the plugin's HTML parser fails to properly escape certain values that it re-emits. This oversight creates an opportunity for malicious actors to inject harmful content into your website.
An unauthenticated attacker can exploit this vulnerability to inject arbitrary web scripts into pages processed by the WebP Express plugin. The term "unauthenticated" means the attacker does not need to log in or have any special permissions on your WordPress site to perform this action. The malicious script is then stored within your site's content. This stored script becomes a persistent threat, waiting for a user to access an affected page.
When any user, including site administrators, views a page containing the injected script, that script executes automatically within their web browser. This client-side execution can lead to various detrimental outcomes. For example, an attacker could steal session cookies, potentially allowing them to hijack a user's session and gain unauthorized access to their account. They might also redirect users to malicious websites, deface the affected pages with unwanted content, or inject phishing forms to trick users into revealing sensitive information. The high severity of this vulnerability, rated with a CVSS score of 7.5, reflects the significant risk posed by such arbitrary script execution.
How to detect a compromise
Detecting a compromise resulting from a Stored Cross-Site Scripting vulnerability can be challenging, particularly if the injected script is designed to be subtle or to execute only under specific conditions. However, several indicators and methods can help identify potential compromises.
One primary method involves reviewing the content of your website for unexpected scripts or altered elements. Attackers often inject JavaScript code, which might appear directly in the page source or be encoded. You can inspect the HTML source code of pages that utilize WebP Express functionality, looking for unusual <script> tags, javascript: URIs, or attributes like onerror, onload, or onmouseover that contain unexpected code. Browser developer tools, accessible by pressing F12 in most browsers, allow you to examine the rendered HTML, network requests, and console logs for any suspicious activity or errors originating from injected scripts. Look for unusual network requests being made from your browser when viewing your site, or JavaScript errors in the console that do not correspond to your legitimate site functionality.
Beyond client-side observation, server-side checks can also provide clues. Review your server's access logs for suspicious requests that might indicate attempts to inject scripts. While the vulnerability allows unauthenticated injection, the logs might show unusual patterns of requests to pages or endpoints associated with image processing or content submission. Additionally, examining your WordPress database for unusual entries in posts, pages, comments, or custom fields that contain script tags or encoded malicious content can be beneficial. A direct database query for common XSS payloads or script tags within content fields might reveal injected data. For example, using a tool like WP-CLI, you could search for suspicious strings within post content: wp db search '<script' --all-tables. However, this requires careful execution and understanding of your database structure. Any unexpected changes to user accounts, such as new administrative users or altered passwords, could also indicate a successful session hijacking following an XSS attack.
How to fix
Addressing this vulnerability requires updating the WebP Express plugin to a version that includes the necessary security patch. Follow these steps to secure your WordPress site:
Backup Your Site: Before performing any updates, create a complete backup of your WordPress site, including both your database and all website files. This ensures you can restore your site if any unforeseen issues arise during the update process.
Access WordPress Admin: Log in to your WordPress administration dashboard.
Navigate to Plugins: In the left-hand menu, go to "Plugins" and then select "Installed Plugins."
Locate WebP Express: Find "WebP Express" in the list of your installed plugins.
Update the Plugin: If an update to version 0.25.16 or later is available, you will see an "Update now" link below the plugin name. Click this link to initiate the update process.
Verify Update: After the update completes, confirm that the plugin's version number is 0.25.16 or higher.
Clear Caches: Clear any caching layers present on your site, including WordPress caching plugins, server-level caches, and CDN caches. This ensures that the updated plugin code is served to all visitors and that any previously cached vulnerable content is removed.
The fix for this vulnerability is included in WebP Express version 0.25.16, which was released on October 18, 2026. This update specifically addresses the vulnerability in the DOM parser library used for altering HTML, which was the root cause of the Stored Cross-Site Scripting issue.
Timeline
Date | Event |
|---|---|
2026-10-18 | Patch released |
2026-10-20 | Vulnerability published |