CVE-2026-97328
CVE-2026-97328 · WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.
CVSS 7.5 · Alta · EPSS 0,3% · Corrección disponible
- Publicación
- Actualización
Productos y versiones afectados
webp express
- Versiones
- ≥ 0, < 0.25.16: Afectada (semver)
Actualiza a 0.25.16