PT-2026-27909 · WordPress · Acato Wp Rest Cache

Published 2026-03-25 · Updated 2026-03-30 · CVE-2026-25347

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions Acato WP REST Cache versions through 2026.1.0

Description The software contains a flaw due to improper handling of user-supplied data during the creation of web pages, leading to a potential 'cross-site scripting' issue. This allows for the injection of malicious scripts that are stored and can be executed when other users access the affected pages. The vulnerability exists in the wp-rest-cache component.

Recommendations Update Acato WP REST Cache to a version later than 2026.1.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-25347

Affected Products

Acato Wp Rest Cache

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-25347 · Security Note
• https://twitter.com/CVEnew/status/2038517010167120009 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/wp-rest-cache/vulnerability/wordpress-wp-rest-cache-plugin-2026-1-0-cross-site-scripting-xss-vulnerability?_s_id=cve · Note