The Super Page Cache plugin allows unauthenticated attackers to inject arbitrary JavaScript into the Activity Log, which is then served to any user who views that page. Because the injected code executes in the victim’s browser, the attacker can hijack sessions, deface content, or exfiltrate sensitive data, leading to significant confidentiality and integrity risks.

WordPress sites using the optimole:Super Page Cache plugin with any version up to and including 5.2.2 are affected. The vulnerability exists in the Activity Log feature, which stores user‑supplied content without proper sanitization or escaping.

The CVSS score of 7.2 indicates a high severity. The EPSS score is less than 1 %, suggesting low current exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw simply by accessing the vulnerability‑prone Activity Log entries, which requires no authentication and therefore can be leveraged by any user, including anonymous visitors.