Threat database

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

The Aruba HiSpeed Cache WordPress plugin up to version 3.0.4 contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing nonce verification in the ahsc_ajax_reset_options() function. This flaw allows an unauthenticated attacker to trick a site administrator into resetting all plugin settings to their default values by making them perform an action such as clicking a malicious link. The vulnerability has a medium severity with a CVSS score of 4.3. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the dbstatus parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

The Aruba HiSpeed Cache plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability checks on the multiple functions in all versions up to, and including, 3.0.2. This makes it possible for unauthenticated attackers to modify plugin's configuration settings, enable or disable features, as well as enable/disable WordPress cron jobs or debug mode