If you run WebP Express with “Alter HTML” turned on, update to 0.25.16 now. CVE-2026-97328 lets anyone, with no login, plant content that WebP Express’s HTML parser turns into working JavaScript. It then runs in the browser of everyone who views the page, administrators included. The plugin is on more than 300,000 sites, but only sites using the non-default Alter HTML mode are exposed. No attacks have been reported, and the proof of concept goes public on November 20, 2026.
At a glance
| CVE | CVE-2026-97328 |
|---|---|
| Plugin | WebP Express (300,000+ active installs), which serves WebP versions of your images |
| Type | Unauthenticated stored cross-site scripting (CWE-79) through the plugin’s bundled HTML parser |
| Severity | CVSS 7.5, high (WPScan). The score assumes a victim has to view the page and that the attack takes some setup |
| Affected | Before 0.25.16, and only when Alter HTML, a non-default delivery mode, is enabled |
| Fixed | 0.25.16 (October 18, 2026) |
| Status | No known exploitation. The proof of concept is due November 20, 2026 |
What’s wrong
WebP Express has two ways to get WebP images to browsers. The default uses server rewrite rules: the browser asks for photo.jpg and quietly gets a WebP file instead. The other, Alter HTML, rewrites the page itself. Before the page goes out, the plugin runs it through a bundled HTML parser and swaps image tags and URLs for WebP versions.
That parser is the problem. It reads the page’s HTML, changes it, and writes it back out. When it writes values back into element attributes, it doesn’t escape them. Text that was harmless where it started, safely encoded inside the page, can come out of the parser as a live attribute, such as an event handler that runs JavaScript.
The advisory says unauthenticated users can submit content that ends up stored and then executed. It doesn’t say where, but the shape of the bug points at anything a visitor can add to a page, such as comments, reviews or form entries shown on the site. The attack runs like this:
- Submit crafted content. The attacker posts something that looks inert as stored, but is built to change meaning when the parser re-emits it.
- Wait for the page to be served. Alter HTML runs the page through the parser, and the payload comes out as a working attribute.
- A visitor loads the page. The script runs on your domain, in their session. If the visitor is an administrator moderating comments or checking the site, the script can act as that administrator.
The same release also closed a second hole: with the plugin’s optional web service turned on, carefully crafted requests could use it without an API key. That one has no CVE, but it’s another reason to update.
What we know about attacks
Nothing so far. WPScan published the advisory on October 20, 2026, and the CVE reached NVD on October 22. CISA’s assessment lists exploitation as “none” and, unlike the PixelYourSite flaw from the same researcher, rates it as not automatable. An attacker has to find a site with Alter HTML on and a place to submit content. That slows mass attacks down. It doesn’t stop targeted ones.
What to do
1. Find out whether you’re exposed
In WordPress, go to Settings → WebP Express and look at the delivery options. If Alter HTML is off, this CVE doesn’t apply to you, but update anyway for the web service fix.
2. Update
Install 0.25.16 or later. If you can’t update right away, turn Alter HTML off. Images will still be served as WebP if the plugin’s redirection rules work on your server, and if they don’t, visitors get the original images. Nothing breaks.
3. Check whether you were hit
- User-submitted content such as comments, reviews and form entries shown on the site. Look for submissions with odd quoting, encoded characters or fragments like
onerror,onloadorjavascript:. - The rendered page where that content appears. View the source and check image tags for attributes you didn’t put there.
- Users. Look for administrator accounts you didn’t create.
- Plugins and must-use plugins. Look for anything you didn’t install, including in
wp-content/mu-plugins/.
Then purge any page cache, so pages built before the update aren’t served again. If you find injected script, treat administrator sessions as compromised: log out all sessions, change passwords and replace the salts in wp-config.php.
4. Don’t let visitors post HTML
Nothing in this attack needs a visitor to post rich content, but many sites still allow it out of habit. Comments that accept only plain text give a parser bug like this far less to work with. If you don’t use comments at all, turn them off in Settings → Discussion, and close them on existing posts too.
The bigger lesson
Every tool that rewrites HTML is an HTML parser, and parsing HTML correctly is hard. WordPress core is rebuilding its own sanitizer on the new HTML API in version 7.2 for exactly this reason. A plugin that takes the finished page, takes it apart and puts it back together has to re-escape everything it writes, or it can turn safe text back into code.
It’s also a reminder of why every plugin should earn its place. Most modern browsers support WebP, WordPress can generate WebP images itself, and many hosts and CDNs convert images on the fly. A plugin that rewrites every page to serve image formats is a lot of moving parts for a job that can often be done at the server, outside PHP entirely.