Description

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-28T16:18:19.657Z",
  "pubdate": "2026-08-28T16:18:19.657Z",
  "executiveSummary": "The WP Rocket WordPress plugin, in versions up to and including 3.21.0.1, contains a critical Stored Cross-Site Scripting (XSS) vulnerability.\nThis security flaw stems from inadequate input sanitization and output escaping mechanisms within the rocket_beacon AJAX endpoint.\nThe vulnerability allows unauthenticated remote attackers to inject malicious JavaScript payloads into the application.\nWhen a victim, such as an administrator or a standard user, accesses the affected page, the malicious script executes within the context of the user's browser session.\nThe potential impact includes unauthorized access to sensitive user data, session hijacking, credential theft, and unauthorized administrative actions performed on behalf of the victim.\nGiven the nature of the attack, it poses a significant risk to site integrity and user security, necessitating immediate attention.\nThe flaw does not require prior authentication, making it accessible to any external attacker capable of reaching the AJAX endpoint.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS) resulting from improper handling of user-supplied input transmitted to the rocket_beacon AJAX endpoint.\nThe root cause of this vulnerability is the failure of the application to properly sanitize incoming request data before storing it in the database and the subsequent failure to apply appropriate output encoding before rendering that data in the browser.\nBy targeting the rocket_beacon endpoint, an unauthenticated attacker can send crafted HTTP requests containing arbitrary script tags.\nThe plugin accepts these inputs without validating or neutralizing malicious characters, effectively storing the payload within the affected WordPress environment.\nThe attack flow follows a predictable pattern: first, the attacker identifies the rocket_beacon AJAX interface. Second, the attacker constructs a malicious payload, typically obfuscated JavaScript, designed to perform actions like stealing session cookies (document.cookie) or redirecting users to malicious domains.\nThird, the attacker sends an unauthenticated POST request to the endpoint containing the payload. Once the payload is stored, the injection is triggered automatically whenever an authorized user loads a page where the stored malicious script is rendered by the application.\nBecause the execution occurs in the context of the victim’s browser, the malicious script inherits the victim's privileges. If the victim is an administrator, the attacker could effectively gain full control over the WordPress instance by creating new administrative accounts, modifying plugin settings, or injecting further persistent backdoors.\nThe affected versions (up to 3.21.0.1) lack the necessary security headers and context-aware escaping functions such as esc_html(), esc_attr(), or js_escape(), which are standard in secure WordPress development.\nThis vulnerability is particularly dangerous because it facilitates persistent malicious code injection that persists across page refreshes and survives until the database entries are manually cleaned or the vulnerability is patched.\nThe lack of authentication requirements broadens the attack surface to include any visitor to the site, allowing automated exploitation attempts to be directed at the endpoint from any internet-connected host.\nSuccessful exploitation bypasses standard client-side protections if the backend does not enforce server-side validation, making this a classic injection-based security flaw within the application layer of the WordPress ecosystem."
}