Threat database

Missing Authorization vulnerability in WP Media WP Rocket wp-rocket allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Rocket: from n/a before 3.23.5.

CVE-2026-97076 is a high-severity vulnerability in WP Media's WP Rocket plugin affecting versions before 3.23.5. It involves an executable regular expression error that allows code injection, potentially leading to denial of service. No confirmed exploits are known in the wild. The vulnerability impacts availability but not confidentiality or integrity.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0.

WP Rocket plugin for WordPress versions up to and including 3.21.0.1 contains a stored cross-site scripting (XSS) vulnerability via the rocket_beacon AJAX endpoint. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when users access affected pages.

Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.

Missing Authorization vulnerability in WP Media Adminimize allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Adminimize: from n/a through 1.11.11.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Media WP Rocket allows Stored XSS.This issue affects WP Rocket: from n/a through 3.19.4.

Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.This issue affects Search & Replace: from n/a through 3.2.2.