Cross-site Scripting Vulnerability in WP Rocket by WP Media
CVE-2026-28044

5.9MEDIUM

Key Information:

Vendor

WordPress
Status
WP Rocket
Vendor
CVE Published:
19 March 2026

What is CVE-2026-28044?

The WP Rocket plugin by WP Media has a Cross-site Scripting (XSS) vulnerability that allows for stored XSS attacks. This flaw occurs due to improper handling of input during web page generation, which could enable attackers to inject malicious scripts into the web pages viewed by unsuspecting users. Affected versions of WP Rocket range from n/a to 3.19.4. It is crucial for users to update their plugin to mitigate the risk associated with this vulnerability.

Affected Version(s)

WP Rocket <= 3.19.4

References

https://patchstack.com/database/wordpress/plugin/wp-rocke...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

stealthcopter | Patchstack Bug Bounty Program
.