The WebP Express plugin, before version 0.25.16, fails to escape values that its bundled HTML parser re‑emits into element attributes when the non‑default image delivery mode is enabled. This flaw allows unauthenticated users to submit content that is stored in the WordPress database and later rendered as JavaScript in the browsers of any visitor to affected pages, including site administrators. The resulting stored XSS provides an attacker with the ability to execute arbitrary code in the context of users who view the compromised pages.

WordPress sites using the WebP Express plugin with a version older than 0.25.16 while the non‑default image delivery mode is active are affected. The vulnerability resides in the plugin’s HTML parser component and does not impact WordPress core or other plugins.

The CVSS score of 7.5 indicates high severity. The EPSS score is not available and the issue is not listed in CISA KEV, but the lack of these metrics does not reduce the potential impact. Exploitation requires no privileged access; an attacker merely needs to submit a crafted value to the plugin’s image delivery path. Successful exploitation results in arbitrary JavaScript execution in the browsers of any user who visits a page rendering the stored content, including privileged administrators. The vulnerability remains available only when the non‑default image delivery mode is enabled.