Stored Cross-Site Scripting Vulnerability in WP Rocket

The WP Rocket plugin for WordPress, in versions up to and including 3.21.0.1, contains a critical Stored Cross-Site Scripting (XSS) vulnerability identified as CVE-2026-5934. The flaw originates from insufficient input sanitization and output escaping mechanisms within the 'rocket_beacon' AJAX endpoint. This vulnerability allows unauthenticated attackers to inject arbitrary malicious web scripts into the plugin's data handling processes. When a user - typically an administrator - accesses the page where the injected script is stored, the browser executes the malicious code. This could lead to session hijacking, unauthorized administrative actions, or persistent defacement of the affected WordPress instance. Defenders should prioritize updating to the latest version to mitigate this injection vector.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of a victim's session. This poses a significant risk to WordPress site integrity, potentially allowing attackers to steal session cookies, perform unauthorized configuration changes, or redirect traffic. The vulnerability impacts all WordPress sites running vulnerable versions of the WP Rocket plugin.

Recommendation

1. Upgrade the WP Rocket plugin to the version that includes the patch for CVE-2026-5934.
2. Implement a strict Content Security Policy (CSP) to mitigate the impact of unauthorized script execution.
3. Monitor web server logs for suspicious requests targeting the 'rocket_beacon' AJAX endpoint.