CVE-2026-97328

7.5 Élevée

Publiée le 22/10/2026 à 08:17 · Modifiée le 22/10/2026 à 13:17 · Reçue · Source : contact@wpscan.com

Description

The WebP Express WordPress plugin before 0.25.16 does not escape values that its bundled HTML parser re-emits into element attributes when a non-default image delivery mode is enabled, allowing unauthenticated users to submit content that is stored and later executed as Cross-Site Scripting in the browser of any user viewing an affected page, including administrators.

Traduire en français

Produits concernés

Unknown WebP Express

Scores CVSS

Version	Score	Source	Vecteur
3.1	7.5 Élevée	134c704f-9b21-4f2e-91b3-4a467353bcc0	`CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H`

Faiblesses (CWE)

CWE-79

Références

https://wpscan.com/vulnerability/f44cb329-fb2e-4fb1-b878-8b52b0c769cc/

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories