Platform
wordpress
Component
wp-rest-cache
Fixed in
2026.1.1
CVE-2026-25347 describes a Stored Cross-Site Scripting (XSS) vulnerability discovered in the WP REST Cache plugin for WordPress. This flaw allows attackers to inject malicious JavaScript code that executes in the context of other users' browsers, potentially leading to account takeover or data theft. The vulnerability affects versions from 0.0 up to and including 2026.1.0, and a patch is available in version 2026.1.1.
The impact of this XSS vulnerability is significant. An attacker could inject malicious scripts into the WP REST Cache plugin's data storage, which would then be served to other users visiting pages utilizing the plugin. This could allow an attacker to steal session cookies, redirect users to phishing sites, deface the website, or even execute arbitrary code on the user's browser. The scope of the impact depends on the plugin's usage and the permissions of affected users; administrators are at the highest risk. Successful exploitation could lead to complete compromise of a WordPress site and its associated data.
CVE-2026-25347 was publicly disclosed on 2026-03-25. There are currently no known public exploits or active campaigns targeting this vulnerability, but the ease of XSS exploitation means it is likely to become a target. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept code is anticipated given the nature of the vulnerability.
Exploit Status
EPSS
0.04% (11% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-25347 is to immediately upgrade the WP REST Cache plugin to version 2026.1.1 or later. If upgrading is not immediately feasible, consider implementing input validation on all user-supplied data processed by the plugin to prevent malicious script injection. A Web Application Firewall (WAF) configured to block XSS payloads targeting the plugin's endpoints can provide an additional layer of defense. Reviewing and sanitizing existing plugin data for any injected scripts is also recommended.
Update to version 2026.1.1, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-25347 is a stored XSS vulnerability in the WP REST Cache plugin for WordPress, allowing attackers to inject malicious scripts. It affects versions 0.0 through 2026.1.0.
You are affected if you are using the WP REST Cache plugin in versions 0.0 to 2026.1.0. Check your plugin version and update immediately if vulnerable.
Upgrade the WP REST Cache plugin to version 2026.1.1 or later. Consider input validation and WAF rules as interim mitigations.
There are currently no confirmed reports of active exploitation, but the vulnerability's nature makes it a likely target.
Refer to the WP REST Cache plugin's official website or WordPress.org plugin repository for the latest advisory and update information.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.