Wp Rest Cache
Monthly
Unauthenticated broken access control in WP REST Cache 2026.3.1 and earlier lets remote attackers read data from affected WordPress sites without logging in, because a plugin-exposed REST function lacks an authorization check (CWE-862). The assessed impact is confidentiality-only (CVSS 7.5, PR:N/UI:N), and exploitation requires the plugin to be installed at an affected version; the exact endpoint and any configuration prerequisite are not described in the available sources. No public exploit was identified at time of analysis, and the priority is this_week rather than emergency.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Acato WP REST Cache WordPress plugin through version 2026.1.0, allowing attackers to inject and persist malicious JavaScript code that executes in the browsers of site administrators and users. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and affects all installations of WP REST Cache up to and including version 2026.1.0. An attacker with appropriate access could inject stored XSS payloads that compromise administrator sessions, steal credentials, or modify site content.
Unauthenticated broken access control in WP REST Cache 2026.3.1 and earlier lets remote attackers read data from affected WordPress sites without logging in, because a plugin-exposed REST function lacks an authorization check (CWE-862). The assessed impact is confidentiality-only (CVSS 7.5, PR:N/UI:N), and exploitation requires the plugin to be installed at an affected version; the exact endpoint and any configuration prerequisite are not described in the available sources. No public exploit was identified at time of analysis, and the priority is this_week rather than emergency.
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Acato WP REST Cache WordPress plugin through version 2026.1.0, allowing attackers to inject and persist malicious JavaScript code that executes in the browsers of site administrators and users. This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation) and affects all installations of WP REST Cache up to and including version 2026.1.0. An attacker with appropriate access could inject stored XSS payloads that compromise administrator sessions, steal credentials, or modify site content.