CVE-2026-1843: Super Page Cache WordPress Plugin XSS Flaw

CVE-2026-1843 Overview

CVE-2026-1843 is a Stored Cross-Site Scripting (XSS) vulnerability in the Super Page Cache plugin for WordPress, affecting all versions up to and including 5.2.2. The flaw exists in the plugin's Activity Log functionality, which fails to perform adequate input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when any user views an affected page. The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads into the plugin's Activity Log, leading to session hijacking, administrative account takeover, and arbitrary actions in the browser context of any user viewing the log.

Affected Products

Super Page Cache plugin for WordPress (also distributed as wp-cloudflare-page-cache)
All versions through 5.2.2
WordPress sites with the plugin's Activity Log feature enabled

Discovery Timeline

2026-02-14 - CVE-2026-1843 published to the National Vulnerability Database
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1843

Vulnerability Analysis

The Super Page Cache plugin records request and event metadata to an Activity Log accessible to site administrators. The plugin writes user-controlled values from HTTP requests into this log without applying WordPress sanitization helpers such as sanitize_text_field() on input. The log entries are then rendered in the WordPress admin interface without escaping helpers such as esc_html() or esc_attr() on output.

This dual failure allows an attacker to submit a crafted request containing HTML or JavaScript that is stored verbatim. When an administrator or other privileged user opens the Activity Log, the browser parses and executes the injected payload in the context of the WordPress site.

Because the attack changes execution context to a privileged session, the scope is changed (S:C). An attacker can leverage the executed script to create new administrator accounts, exfiltrate nonces, modify plugin settings, or pivot to further actions through the WordPress REST API.

Root Cause

The root cause is insufficient input sanitization combined with missing output escaping in the Activity Log code path. WordPress provides a well-defined set of sanitization and escaping functions, and the plugin failed to apply them to attacker-controlled request fields recorded into log entries.

Attack Vector

The attack is delivered over the network and requires no authentication or user interaction beyond the eventual viewing of the Activity Log by a privileged user. An attacker sends an HTTP request to the target WordPress site containing malicious script content in a field that the plugin captures into its Activity Log. The payload remains stored until a logged-in administrator views the log, at which point the script executes in the administrator's browser.

Detailed technical context is available in the Wordfence Vulnerability Report and the WordPress Plugin Changeset that introduces the fix.

Detection Methods for CVE-2026-1843

Indicators of Compromise

Activity Log entries containing HTML tags such as <script>, <img onerror=, or <svg onload=
Unexpected administrator accounts or modified user roles in wp_users and wp_usermeta
Outbound HTTP requests from administrator browsers to unknown domains shortly after viewing the plugin's Activity Log
Plugin or theme installations from the WordPress admin that do not correlate with legitimate administrator activity

Detection Strategies

Inspect the Super Page Cache Activity Log database table for entries containing angle brackets, javascript: URIs, or HTML event handlers
Review WordPress access logs for unauthenticated POST or GET requests targeting plugin endpoints with suspicious payloads
Compare the installed plugin version against 5.2.2; any version at or below is vulnerable
Deploy a Web Application Firewall (WAF) rule set that flags XSS payload patterns in requests to WordPress sites

Monitoring Recommendations

Alert on creation of WordPress administrator accounts outside change-control windows
Monitor file integrity for wp-content/plugins/wp-cloudflare-page-cache/ to detect unauthorized modification
Forward WordPress audit logs to a centralized SIEM and correlate plugin log writes with administrative session activity
Track outbound traffic from administrative workstations for connections to recently registered domains

How to Mitigate CVE-2026-1843

Immediate Actions Required

Update the Super Page Cache plugin to the version released in changeset 3454474 or later
Purge existing Activity Log entries to remove any stored payloads before administrators view the log
Rotate WordPress administrator passwords and invalidate active sessions if compromise is suspected
Audit wp_users for unauthorized accounts created after the plugin was installed

Patch Information

The vendor addressed the issue in the plugin update referenced by WordPress Plugin Changeset 3454474. The fix applies proper sanitization on input and escaping on output for Activity Log entries. Sites running version 5.2.2 or earlier must upgrade to the patched release.

Workarounds

Disable the Activity Log feature in the Super Page Cache plugin configuration until the patch is applied
Deactivate the plugin entirely on high-value WordPress installations where immediate patching is not feasible
Restrict access to the WordPress admin interface by IP allowlist at the web server or WAF tier
Apply a WAF rule that blocks requests containing HTML or script tags destined for plugin endpoints

bash

# Example: WP-CLI commands to update the plugin and verify the installed version
wp plugin update wp-cloudflare-page-cache
wp plugin get wp-cloudflare-page-cache --field=version