CVE-2026-15889: Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Content in all versions up to, and including, 3.0.14 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Aruba HiSpeed Cache (WordPress plugin)to a version that resolves this vulnerability.Fixed in 3.0.14
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs an authenticated WordPress account with at least the Contributor role. They can place malicious script content in a post, which runs when another user views the affected page.
Are sites affected by default?
The issue affects Aruba HiSpeed Cache plugin versions through 3.0.14 when Contributor-or-higher users can create or edit content that is subsequently viewed. Exploitation does not require user interaction from the attacker, but a victim must access the injected page for the script to execute.
How can I determine whether my site may already be affected?
Review posts created or modified by Contributor-level and higher accounts for unexpected or suspicious script content. Also review account activity for untrusted contributor accounts and inspect pages those accounts have published or submitted.