CVE-2026-5934 in WP Rocket Plugin
Summary
by MITRE • 08/28/2026
The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified within WP Rocket versions up to 3.21.0.1 represents a critical security flaw classified as Stored Cross-Site Scripting, or XSS. This type of attack is particularly dangerous because the malicious payload is permanently stored on the target server, typically in a database, rather than being sent only via HTTP requests like reflected XSS. In this specific instance, the vulnerability stems from insufficient input sanitization and output escaping mechanisms within the rocket_beacon AJAX endpoint. Because WP Rocket is one of the most widely used caching plugins for WordPress, which powers a significant portion of the web, the potential blast radius of this vulnerability extends to millions of websites that rely on it for performance optimization. The lack of proper validation allows unauthenticated attackers to inject arbitrary JavaScript code into the application's data stores without needing valid credentials or prior authentication.
From a technical perspective, the flaw resides in how user-supplied data is handled during the AJAX request processing phase. When an attacker sends a crafted payload through the rocket_beacon endpoint, the plugin fails to adequately sanitize the input before storing it and subsequently fails to escape the output when rendering pages that include this stored data. This dual failure ensures that the injected script remains intact in the database and is executed by any user's browser who views the affected page. The execution context of these scripts is within the victim’s session, meaning they inherit all privileges associated with that user account on the site. If the targeted user has administrative capabilities, the attacker can escalate their access to gain full control over the WordPress installation.
The operational impact of this vulnerability is severe and multifaceted. Attackers can use the injected scripts to steal sensitive information such as session cookies, authentication tokens, or personal data displayed on the page. Furthermore, they can perform actions on behalf of the victim, including modifying site content, creating new administrative accounts, or defacing the website. In enterprise environments where WP Rocket is deployed for performance reasons, this vulnerability could lead to widespread compromise if not addressed promptly. The persistent nature of stored XSS means that every user visiting the compromised page becomes a potential target, amplifying the risk significantly compared to one-time exploitation vectors.
This incident aligns with Common Weakness Enumeration (CWE) identifiers such as CWE-79 for Improper Neutralization of Input During Web Page Generation and CWE-83 for Stored XSS. It also maps to MITRE ATT&CK techniques including T1059, which covers Command and Scripting Interpreter execution via browser-based attacks, and potentially T1078 if the attacker uses stolen credentials or injected scripts to maintain persistence within the system. The attack vector is classified as Network-Based with Low Complexity due to its unauthenticated nature, making it easily exploitable by automated tools across the internet.
Mitigation strategies must focus on immediate remediation through software updates and enhanced security practices. Administrators should upgrade WP Rocket to version 3.21.0.2 or later, where these input sanitization and output escaping issues have been resolved. In addition to updating the plugin, organizations should implement Web Application Firewalls that can detect and block common XSS patterns in AJAX requests. Regular vulnerability scanning of WordPress installations is essential to identify outdated plugins before they are exploited. Furthermore, enforcing strict Content Security Policy headers can help mitigate the impact of any successful injection by restricting the sources from which scripts can be loaded or executed, thereby reducing the effectiveness of the malicious code even if it manages to bypass other defenses.