This vulnerability allows an attacker to inject arbitrary JavaScript into WordPress pages through the insecure rocket_beacon Ajax endpoint of WP Rocket up to version 3.21.0.1. The stored payload runs in every user’s browser that visits the affected page, enabling session theft, browser data exfiltration, defacement, or other downstream attacks. The weakness is a classic input validation failure (CWE‑79).

All WordPress sites that have the WP Rocket plugin version 3.21.0.1 or earlier installed are affected. The vulnerability resides in the WP Media WP Rocket plugin, which is commonly used on production and staging sites. Any user who can access a page rendered by the plugin after an injection can execute attacker‑sourced scripts.

The CVSS score of 7.2 indicates a medium‑to‑high severity vulnerability. No EPSS data is available, but the lack of an exploit in the KEV database suggests it is not yet widely exploited. Attackers can reach the vector from any network without requiring authentication, simply by sending crafted requests to the rocket_beacon endpoint. Once a script is stored, all subsequent page views trigger execution in the victim’s browser.