This vulnerability (CVE-2026-28044) in WP Media's WP Rocket plugin is a stored cross-site scripting (CWE-79) flaw caused by improper input neutralization during web page generation. It affects all versions through 3.19.4. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requiring high privileges and user interaction, with a scope change and low impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation could allow an attacker with high privileges to inject malicious scripts that execute in the context of other users, potentially leading to data disclosure, integrity loss, or availability impact. However, exploitation requires user interaction and high privileges, limiting the attack surface. The medium CVSS score reflects these factors.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit high-privilege user access and monitor for suspicious activity related to script injection. Avoid granting unnecessary privileges to users who can interact with the plugin.