WP Rocket vulnerabilities

The WP Rocket plugin for WordPress (versions before 3.23.5) contains a Missing Authorization vulnerability caused by incorrectly configured access control security levels. This allows exploitation of improperly configured security mechanisms.

Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection. This issue affects WP Rocket: from n/a before 3.23.5.

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.