Improper neutralization of input during web page generation allows an attacker to store malicious script content that will be executed when normal users view affected pages. The vulnerability is a stored cross‑site scripting (XSS) flaw, meaning that once an attacker can submit or modify data that the WP Rocket plugin retains, the malicious code will run in the browsers of site visitors. Potential impact includes theft of session cookies, defacement of site content, or execution of further web‑based attacks against site users.

The WP Media WP Rocket plugin for WordPress is affected, specifically any installation running a version from the earliest available up to and including 3.19.4. Versions 3.20.0.2 and later are not affected.

The CVSS score of 5.9 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is through user‑submitable content that the plugin stores; an attacker would need the ability to create or edit such content, typically via an admin, editor, or by exploiting the plugin’s configuration interface.