CVE-2026-25347 is a stored cross-site scripting vulnerability in the Acato WP REST Cache WordPress plugin. The issue stems from improper neutralization of input during web page generation, which allows attackers to inject malicious scripts that persist and execute in the context of users visiting affected pages. The vulnerability affects all versions up to 2026.1.0. The CVSS 3.1 base score is 7.1, reflecting network exploitability without privileges but requiring user interaction, and impacts confidentiality, integrity, and availability to a limited extent. No official patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of affected users, potentially leading to partial disclosure of sensitive information, modification of data, or disruption of service. The CVSS vector indicates that the attack can be performed remotely without privileges but requires user interaction. The impact is rated as high severity due to the potential combined effect on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or limiting use of the WP REST Cache plugin to reduce exposure. Monitor official Acato communications for updates and apply patches promptly once available.