EUVD-2026-75366
GHSA-7hqr-g783-r743
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Contributor credentials required (PR:L); victim must visit the page (UI:R, not UI:N); cross-browser scope change; no server-side confidentiality or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in the Aruba HiSpeed Cache WordPress plugin (all versions ≤ 3.0.14) allows authenticated Contributor-level users to inject persistent JavaScript via post content that executes in any visitor's browser when they access the affected page. The scope change in the CVSS vector (S:C) correctly reflects that execution occurs in victims' browser contexts - enabling session hijacking, credential theft, or further site compromise against administrators who visit the page. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires authenticated access to the target WordPress site at Contributor level or higher (PR:L per CVSS). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The reported CVSS 6.4 score (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) captures the network-reachable, low-complexity, low-privilege nature of the attack with cross-context scope change. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Aruba HiSpeed Cache plugin to the version patched in WordPress plugin repository changeset 3674227 (https://plugins.trac.wordpress.org/changeset/3674227/); the exact tagged release version post-fix is not independently confirmed in the available data, so administrators should verify the latest version available in the WordPress plugin directory is newer than 3.0.14. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Aruba Hispeed Cache
View allExposure of Sensitive Information to an Unauthorized Actor vulnerability in Aruba.It Aruba HiSpeed Cache.0.6. Rated medi
Cross-site request forgery in Aruba HiSpeed Cache WordPress plugin up to version 3.0.4 allows unauthenticated attackers
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today