Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.4

WordPress xSpeed Cache plugin lets logged‑in users inject scripts

CVE-2026-109985 · published 19 days ago
Summary

The xSpeed Cache plugin for WordPress allows users who can edit content (contributors or higher) to place harmful code into page content. When a visitor views the affected page, the malicious code runs in their browser, potentially stealing data or altering the site display. Update the plugin to a version where the input is properly cleaned, or disable the feature until it is fixed, and restrict editing access to trusted users.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
wpdevteam xspeed cache: ai-powered performance hub with mcp, caching & cdn <= 1.4.2
Original advisory text
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'post_content' Parameter
The xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 1.4.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-79Cross-site Scripting (XSS)
Timeline
Published17 Oct 2026
Updated4 Nov 2026
First seen17 Oct 2026
Sources
CVE-2026-109985 · NVD
CVE-2026-109985 · MITRE
Track software like this
Free during beta