CVE-2026-109985: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wpdevteam xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN

CVE-2026-109985 describes a stored cross-site scripting vulnerability in the wpdevteam xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN WordPress plugin. The flaw exists in all versions up to and including 1.4.2, where the 'content' parameter is not properly sanitized or escaped. This allows authenticated attackers with contributor or higher privileges to inject arbitrary JavaScript code that executes in the context of users visiting the injected pages, potentially leading to session hijacking or other client-side impacts.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages, which execute in the browsers of users who visit those pages. This can lead to information disclosure or other client-side impacts. The CVSS score of 6.4 (medium severity) reflects the network attack vector, low attack complexity, and privileges required, with no user interaction needed and partial confidentiality and integrity impact.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict contributor-level access carefully and consider removing or limiting the use of the vulnerable plugin version. Implementing additional web application firewall (WAF) rules to detect and block malicious input may help mitigate risk.