Wp Rest Cache CVE-2026-25347

Acato WP REST Cache plugin version ≤ 2026.1.0 installed on WordPress. Attacker must inject malicious payload via REST API or plugin settings. Victim must view the compromised page/admin interface. No authentication required for initial injection; victim interaction needed to trigger stored XSS.

While CVSS and EPSS scores are not numerically available for this CVE, the vulnerability type (Stored XSS) carries inherent high severity due to its persistent nature and lack of user interaction requirement for exploitation. Stored XSS vulnerabilities typically present higher real-world risk than reflected variants because the malicious payload persists and affects all users who view the compromised content. The absence of public EPSS data and KEV inclusion status prevents quantitative exploitation probability assessment, but Stored XSS in plugin-based systems like WordPress is frequently targeted. The attack complexity appears low (REST API endpoints are commonly accessible), and successful exploitation could lead to session hijacking, credential theft, or site-wide compromise. This should be treated as a high-priority vulnerability for all affected installations, particularly those with public-facing REST API endpoints.

An attacker with contributor or subscriber-level access to the WordPress site (or via an unauthenticated REST API endpoint if misconfigured) crafts a malicious payload containing JavaScript code and injects it through a WP REST Cache endpoint parameter that is improperly sanitized. The payload is stored in the cache layer and subsequently served to all site administrators and users who access the affected cached content, causing the malicious script to execute in their browsers with their privileges—enabling session theft, admin credential harvesting, or malware distribution without requiring user interaction beyond normal site browsing.