CVE-2026-25347: WP REST Cache Stored XSS Vulnerability

CVE-2026-25347 Overview

CVE-2026-25347 is a Stored Cross-Site Scripting (XSS) vulnerability in the Acato WP REST Cache WordPress plugin. The vulnerability stems from improper neutralization of input during web page generation, allowing attackers to inject malicious scripts that persist in the application and execute in the browsers of other users who access the affected pages.

Critical Impact

This Stored XSS vulnerability can be exploited remotely without authentication, potentially compromising user sessions, stealing credentials, and enabling further attacks against WordPress site visitors.

Affected Products

• WP REST Cache plugin versions through 2026.1.0
• WordPress sites using vulnerable versions of the wp-rest-cache plugin

Discovery Timeline

• 2026-03-25 - CVE-2026-25347 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-25347

Vulnerability Analysis

This vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The Stored XSS variant is particularly dangerous because malicious scripts are permanently stored on the target server, such as in a database, message forum, visitor log, or comment field. When victims retrieve the stored information, the malicious script is served as part of the legitimate page content.

The vulnerability in WP REST Cache allows an attacker to inject arbitrary JavaScript code that gets stored and later executed when other users interact with the cached REST API responses. This can lead to session hijacking, defacement, or redirection to malicious sites.

Root Cause

The root cause of this vulnerability is insufficient input sanitization and output encoding in the WP REST Cache plugin. When the plugin processes and stores REST API responses for caching purposes, it fails to properly neutralize user-controllable input, allowing malicious script content to be stored and later rendered without proper escaping.

Attack Vector

The attack can be executed remotely over the network and requires user interaction—a victim must view or interact with the page containing the stored malicious payload. The vulnerability does not require authentication to exploit, making it accessible to unauthenticated attackers. The scope is changed, meaning the vulnerability can affect resources beyond the vulnerable component's security scope.

An attacker would typically craft a malicious payload containing JavaScript code and submit it through an input mechanism that gets processed by the WP REST Cache plugin. Once stored, any user accessing the cached content would have the malicious script executed in their browser context.

Detection Methods for CVE-2026-25347

Indicators of Compromise

• Unexpected JavaScript code or <script> tags appearing in cached REST API responses
• Unusual database entries in WordPress cache tables containing encoded or obfuscated script content
• Browser console errors or unexpected network requests from affected WordPress pages
• User reports of suspicious redirects or credential harvesting attempts when visiting the site

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block XSS payloads in incoming requests
• Monitor WordPress database tables associated with the WP REST Cache plugin for suspicious content patterns
• Deploy Content Security Policy (CSP) headers and monitor for policy violations
• Conduct regular security scans of WordPress installations using vulnerability assessment tools

Monitoring Recommendations

• Enable comprehensive logging for all REST API endpoints and cache operations
• Set up alerts for unusual patterns in cached content or database modifications
• Monitor for new or modified script inclusions across WordPress pages
• Review web server access logs for patterns consistent with XSS exploitation attempts

How to Mitigate CVE-2026-25347

Immediate Actions Required

• Update the WP REST Cache plugin to a patched version as soon as one becomes available
• Temporarily disable the WP REST Cache plugin if an update is not yet available
• Clear all existing cached data that may contain stored XSS payloads
• Implement a Web Application Firewall with XSS protection rules
• Review and sanitize any existing cache entries before re-enabling the plugin

Patch Information

Organizations should monitor the Patchstack WordPress Plugin Advisory for official patch announcements from Acato. Upgrade to a version newer than 2026.1.0 once a security fix is released.

Workarounds

• Disable the WP REST Cache plugin entirely until a patch is available
• Implement strict Content Security Policy (CSP) headers to mitigate script execution
• Use a WAF to filter and block common XSS attack patterns
• Limit access to REST API endpoints where possible to reduce the attack surface
• Regularly purge and regenerate cache data to minimize exposure window

# WordPress CLI commands to disable the vulnerable plugin
wp plugin deactivate wp-rest-cache

# Clear any cached data (adjust table names based on plugin implementation)
wp cache flush

# Verify plugin status
wp plugin status wp-rest-cache