webp_express vulnerabilities

CVEs whose affected-version data names the webp_express package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-97328None

today

WebP Express < 0.25.16 - Unauthenticated Stored XSS via Alter HTML Parser

The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content tha…

▾ Sunlitvia CVEORG