CVE-2026-5934: falha de alta gravidade em WP Rocket
WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 7.2epss 0.3%
The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Produtos afetados
WP Media · WP RocketCVEs relacionadas — WP Rocket
No mesmo produto, das mais perigosas para as menos.
CVE-2026-97076HIGHWordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerabilityEPSS 0.3%CVE-2026-97075MEDIUMWordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2026-28044MEDIUMWordPress WP Rocket plugin <= 3.19.4 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.1%