PLUGIN SECURITY
Is Webp Express safe?
Serve autogenerated WebP images instead of jpeg/png to browsers that supports WebP.
What this plugin does
- Slug:
webp-express - Author: rosell.dk
- 300000+ active installs
- 88/100 rating (161 reviews on wordpress.org)
- 4429264 all-time downloads
- On WordPress.org since 2018-08-01
imagesperformancewebp
Maintenance status
- Latest known version: 0.25.15
- Last updated: 2026-06-19 1:12pm GMT
- Tested up to WordPress: 6.9.7
- Requires PHP: 5.6+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
3 known CVEs on file for Webp Express. Reported between 2018 and 2025.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2025-11379 | WebP Express [webp-express] < 0.25.11 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 0.25.11 | 0.25.11 | 2025-12-03 | ✓ fixed in latest |
| CVE-2019-15837 | WebP Express [webp-express] < 0.14.11 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 0.14.11 | 0.14.11 | 2019-06-26 | ✓ fixed in latest |
| — | WebP Express [webp-express] < 0.14.8 | — | Unknown | < 0.14.8 | 0.14.8 | 2019-06-26 | ✓ fixed in latest |
| — | WebP Express [webp-express] < 0.14.1 | — | Unknown | < 0.14.1 | 0.14.1 | 2019-06-16 | ✓ fixed in latest |
| CVE-2019-15330 | WebP Express [webp-express] < 0.14.11 | — | High 7.5 | < 0.14.11 | 0.14.11 | 2018-12-11 | ✓ fixed in latest |
How to fix it
Keep Webp Express updated — 0.25.15 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- LiteSpeed Cache — 7000000+ active installs — 96/100 (2764) — max PHP 8.4
- Jetpack – WP Security, Backup, Speed, & Growth — 3000000+ active installs — 74/100 (2406)
- WP Super Cache — 1000000+ active installs — 86/100 (1345) — max PHP 8.4
- Speed Optimizer – The All-In-One Performance-Boosting Plugin — 1000000+ active installs — 84/100 (639) — max PHP 8.4
- WP Fastest Cache – WordPress Cache Plugin — 1000000+ active installs — 98/100 (4224) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.