The vulnerability is a stored cross‑site scripting flaw that allows an authenticated user with contributor or higher privileges to inject arbitrary script code via the plugin’s content parameter. When an affected page is accessed, the injected script executes in the victim’s browser, potentially enabling session hijack, defacement, or other malicious actions. The flaw arises from insufficient input sanitization and output escaping implemented by the plugin.

This issue impacts the WordPress plugin xSpeed Cache: AI‑Powered Performance Hub with MCP, Caching & CDN released by wpdevteam, affecting all official releases up to and including version 1.4.2. The vulnerability exists in the code that handles user‑supplied content for cached pages.

The CVSS score of 6.4 indicates a moderate severity, and the issue is not yet listed in the CISA KEV catalog. Exploitation requires only contributor level access, a role often granted to multiple collaborators in a WordPress site, making the threat practical for an attacker who has already compromised or compromised credentials. Because the flaw involves stored user input, once an attacker injects content it persists in the database and affects all future page loads for any visitor. Even though the EPSS score is not available, the combination of moderate CVSS and readily available attack vector suggests a significant risk to sites that rely on this plugin and have not applied a fix.