Unauthenticated attackers can inject malicious scripts into pages via the WebP Express plugin's HTML parser when a non-default image delivery mode is active.
Affected component: WebP Express (plugin)
Fixed in: 0.25.16
PowerSEC coverage: PowerSEC detects the affected versions on every plan, and has since October 24, 2026. No PowerSEC firewall rule blocks this attack. Update to 0.25.16 or later to remove the vulnerability.
Full advisory, including detection steps and remediation: https://powersec.io/vulnerability/cve-2026-97328