{"id":"CVE-2026-97328","revision":"5d314548ee6d46b9b21090c455eb0a66","records":[{"revision":"5d314548ee6d46b9b21090c455eb0a66","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-97328","aliases":[],"title":"WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser","description":"The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.","state":0,"publishedAt":"2026-10-22T06:00:18.825+00:00","modifiedAt":"2026-10-22T11:06:28.335+00:00","affected":[{"ecosystem":"Vendor product","name":"WebP Express","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"WebP Express\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"0.25.16\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/f44cb329-fb2e-4fb1-b878-8b52b0c769cc/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-97328","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-97328","identifiers":["CVE-2026-97328"]},"retained":false,"historicalAffected":[]}],"coverage":[]}