Cross-Site Scripting Vulnerability in Acato WP REST Cache Plugin
CVE-2026-25347

7.1HIGH

Key Information:

Vendor

WordPress
Status
WP Rest Cache
Vendor
CVE Published:
25 March 2026

What is CVE-2026-25347?

The Acato WP REST Cache plugin is vulnerable to Stored Cross-Site Scripting (XSS), allowing attackers to inject malicious scripts into web pages. This can lead to unintended execution of script in user browsers, potentially compromising user accounts and sensitive information. Users of affected versions must ensure that their installations are updated promptly to mitigate this risk.

Affected Version(s)

WP REST Cache 0 <= 2026.1.0

References

https://patchstack.com/database/Wordpress/Plugin/wp-rest-...
vdb-entry

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Ba Khanh | Patchstack Bug Bounty Program
.