CVE-2026-5934

CVE-2026-5934 is a stored cross-site scripting (XSS) vulnerability in the WP Rocket WordPress caching plugin affecting all versions up to and including 3.21.0.1, caused by insufficient input sanitization and output escaping of user-supplied data handled by the rocket_beacon AJAX endpoint. An unauthenticated attacker can submit malicious data to that endpoint, which is then stored so that arbitrary web scripts execute in the browser of anyone who views an injected page. Successful exploitation lets the attacker run JavaScript in the context of site visitors, including potentially privileged users, which can expose session or page data and enable limited actions on their behalf, consistent with the low confidentiality and integrity ratings in the 7.2 (high) CVSS score. All WordPress sites running WP Rocket 3.21.0.1 or earlier are affected; WP Rocket is a premium caching plugin with a very large installed base. As of now there is no public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only about a 0.2% probability of exploitation within 30 days, so no exploitation is known.

What to do: Update WP Rocket to the latest release, i.e., any version above 3.21.0.1, and verify the installed version in your plugin list. As an interim measure, block or rate-limit unauthenticated requests to the admin-ajax.php 'rocket_beacon' action (for example via WAF rules) and review recently modified pages for unexpected injected scripts. No in-the-wild exploitation is currently known, but the high severity rating warrants prompt patching.