Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webhue WH Cache & Security wh-cache-and-security allows Reflected XSS.This issue affects WH Cache & Security: from n/a through <= 1.1.2.
Published: 2025-01-22
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The WH Cache & Security plugin fails to neutralize user input before rendering it into web pages, creating a Reflected Cross‑Site Scripting vulnerability. Because the data is reflected back without proper escaping, an attacker can supply crafted input that is executed in the victim’s browser.

Affected Systems

All releases of WH Cache & Security from the initial version up through 1.1.2, distributed by webhue, contain the flaw. No versions newer than 1.1.2 are listed as affected.

Risk and Exploitability

The CVSS score of 7.1 indicates a high‑impact flaw, while the EPSS score of less than 1 % signifies that real‑world exploitation is currently considered unlikely. The vulnerability is not present in the CISA KEV catalog. The most likely attack vector appears to be a user‑directed request containing malicious input, inferred from the reflected nature of the flaw.

Generated by OpenCVE AI on May 2, 2026 at 05:45 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade WH Cache & Security to the most recent release available from webhue, which removes the reflected XSS flaw.
  • If an upgrade is not immediately possible, disable or uninstall the WH Cache & Security plugin to eliminate the exposed input processing.
  • Implement a Content Security Policy that restricts script origins and disallows inline scripts to provide additional defense while the plugin remains installed.

Generated by OpenCVE AI on May 2, 2026 at 05:45 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-3285 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WH Cache & Security allows Reflected XSS. This issue affects WH Cache & Security: from n/a through 1.1.2.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WH Cache & Security allows Reflected XSS. This issue affects WH Cache & Security: from n/a through 1.1.2. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in webhue WH Cache & Security wh-cache-and-security allows Reflected XSS.This issue affects WH Cache & Security: from n/a through <= 1.1.2.
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Wed, 22 Jan 2025 20:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 22 Jan 2025 14:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NotFound WH Cache & Security allows Reflected XSS. This issue affects WH Cache & Security: from n/a through 1.1.2.
Title WordPress WH Cache & Security plugin <= 1.1.2 - Reflected Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:11:14.639Z

Reserved: 2025-01-16T11:27:03.858Z

Link: CVE-2025-23611

cve-icon Vulnrichment

Updated: 2025-01-22T16:16:34.461Z

cve-icon NVD

Status : Deferred

Published: 2025-01-22T15:15:19.610

Modified: 2026-06-17T08:55:47.060

Link: CVE-2025-23611

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T06:00:13Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')