CVE-2026-28044

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-28044", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-25T12:13:30.134Z", "datePublished": "2026-03-19T05:21:26.027Z", "dateUpdated": "2026-04-28T16:15:05.132Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "WP Rocket", "vendor": "WP Media", "versions": [{"changes": [{"at": "3.20.0.2", "status": "unaffected"}], "lessThanOrEqual": "3.19.4", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "stealthcopter | Patchstack Bug Bounty Program"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media WP Rocket allows Stored XSS.<p>This issue affects WP Rocket: from n/a through 3.19.4.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media WP Rocket allows Stored XSS.This issue affects WP Rocket: from n/a through 3.19.4."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:15:05.132Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/wp-rocket/vulnerability/wordpress-wp-rocket-plugin-3-19-4-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update the WordPress WP Rocket plugin to the latest available version (at least 3.20.0.2)."}], "value": "Update the WordPress WP Rocket plugin to the latest available version (at least 3.20.0.2)."}], "source": {"discovery": "EXTERNAL"}, "title": "WordPress WP Rocket plugin <= 3.19.4 - Cross Site Scripting (XSS) vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-19T13:52:35.959806Z", "id": "CVE-2026-28044", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T13:52:45.697Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-28044", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-19T13:52:35.959806Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-19T13:52:41.279Z"}}], "cna": {"title": "WordPress WP Rocket plugin <= 3.19.4 - Cross Site Scripting (XSS) vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "stealthcopter | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "WP Media", "product": "WP Rocket", "versions": [{"status": "affected", "changes": [{"at": "3.20.0.2", "status": "unaffected"}], "version": "n/a", "versionType": "custom", "lessThanOrEqual": "3.19.4"}], "defaultStatus": "unaffected"}], "solutions": [{"lang": "en", "value": "Update the WordPress WP Rocket plugin to the latest available version (at least 3.20.0.2).", "supportingMedia": [{"type": "text/html", "value": "Update the WordPress WP Rocket plugin to the latest available version (at least 3.20.0.2).", "base64": false}]}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/wp-rocket/vulnerability/wordpress-wp-rocket-plugin-3-19-4-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media WP Rocket allows Stored XSS.This issue affects WP Rocket: from n/a through 3.19.4.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media WP Rocket allows Stored XSS.<p>This issue affects WP Rocket: from n/a through 3.19.4.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-03-19T05:21:26.027Z"}}}, "cveMetadata": {"cveId": "CVE-2026-28044", "state": "PUBLISHED", "dateUpdated": "2026-03-19T13:52:45.697Z", "dateReserved": "2026-02-25T12:13:30.134Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-03-19T05:21:26.027Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "WP Rocket", "vendor": "WP Media", "versions": [{"changes": [{"at": "3.20.0.2", "status": "unaffected"}], "lessThanOrEqual": "3.19.4", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media WP Rocket allows Stored XSS.This issue affects WP Rocket: from n/a through 3.19.4."}, {"lang": "es", "value": "Neutralizaci\u00f3n Incorrecta de la Entrada Durante la Generaci\u00f3n de P\u00e1ginas Web ('cross-site scripting') vulnerabilidad en WP Media WP Rocket permite XSS Almacenado. Este problema afecta a WP Rocket: desde n/a hasta 3.19.4."}], "id": "CVE-2026-28044", "lastModified": "2026-06-17T10:28:09.107", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 3.7, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-28044", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-19T13:52:35.959806Z", "version": "2.0.3"}}]}, "published": "2026-03-19T06:16:26.173", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/wp-rocket/vulnerability/wordpress-wp-rocket-plugin-3-19-4-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.0.0,3.19.4]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.20.0.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "WP Rocket", "source": "cna", "vendor": "WP Media"}, "product": "wp_rocket", "vendor": "wp_media"}], "analysis": {"en": {"generated_at": "2026-04-28T22:19:51.429132+00:00", "value": {"mitigation_remediation": ["Update the WordPress WP Rocket plugin to version 3.20.0.2 or later.", "Remove or disable the WP Rocket plugin until the patch is applied.", "If an immediate update is not possible, restrict the plugin\u2019s access to trusted administrators only and monitor stored content for malicious scripts."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "The WP Media WP Rocket plugin for WordPress is affected, specifically any installation running a version from the earliest available up to and including 3.19.4. Versions 3.20.0.2 and later are not affected.", "description_and_impact": "Improper neutralization of input during web page generation in the WP Media WP Rocket plugin allows an attacker to store malicious script content that will be executed when site visitors view affected pages. The flaw is a stored cross\u2011site scripting (XSS) vulnerability, meaning that once an attacker can submit or modify data that the plugin retains, the embedded code will run in users\u2019 browsers. Impacts may include session hijacking, defacement, or further web\u2011based attacks on site visitors. The issue affects WP Rocket versions up through 3.19.4.", "risk_and_exploitability": "The CVSS score of 5.9 indicates moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through user\u2011submitable content that the plugin stores; an attacker would need the ability to create or edit such content, typically via an admin, editor, or by exploiting the plugin\u2019s configuration interface."}}}}, "created": "2026-03-19T08:54:39.532455+00:00", "updated": "2026-04-28T22:30:41.600207+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wp_media", "wp_media$PRODUCT$wp_rocket"]}