Improper neutralization of input during web page generation in the WP Media WP Rocket plugin allows an attacker to store malicious script content that will be executed when site visitors view affected pages. The flaw is a stored cross‑site scripting (XSS) vulnerability, meaning that once an attacker can submit or modify data that the plugin retains, the embedded code will run in users’ browsers. Impacts may include session hijacking, defacement, or further web‑based attacks on site visitors. The issue affects WP Rocket versions up through 3.19.4.

The WP Media WP Rocket plugin for WordPress is affected, specifically any installation running a version from the earliest available up to and including 3.19.4. Versions 3.20.0.2 and later are not affected.

The CVSS score of 5.9 indicates moderate severity. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through user‑submitable content that the plugin stores; an attacker would need the ability to create or edit such content, typically via an admin, editor, or by exploiting the plugin’s configuration interface.