WP Rocket

WP Rocket has 6 disclosed vulnerabilities in the WordSec catalog, reported between 2017 and 2026; all 6 are fixed as of October 2026. Their average CVSS score is 6.5, and the most serious one scores 7.5 out of 10. Severity breakdown: 0 critical and 3 high. 2026 was the busiest year with 4 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (33%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Missing Authorization.

Every one of the 6 issues recorded for WP Rocket has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each.

Strategic Overview

Avg CVSSMedium

6.5/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all WP Rocket vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.5CVE-2026-97076

WP Rocket < 3.23.5 - Unauthenticated Denial of Service

Read the full analysis

Vulnerability Records

6 records


2026-10-07 00:00	WP Rocket < 3.23.5 - Missing Authorization WP Rocket < 3.23.5	`CVE-2026-97075`	5.3 Medium	T.Kalimullin	Yes
2026-10-07 00:00	WP Rocket < 3.23.5 - Unauthenticated Denial of Service WP Rocket < 3.23.5	`CVE-2026-97076`	7.5 High	sahinyes	Yes
2026-08-28 00:00	WP Rocket 3.23.1 - 3.23.3.2 - Unauthenticated Information Exposure WP Rocket 3.23.1 – 3.23.3.2	`N/A`	5.3 Medium	Anonymous	Yes
2026-08-27 00:00	WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint WP Rocket <= 3.21.0.1	`CVE-2026-5934`	7.2 High	Tin Pham (TF1T)	Yes
2025-10-20 00:00	Rocket <= 3.19.4 - Authenticated (Author+) Stored Cross-Site Scripting WP Rocket <= 3.19.4	`CVE-2026-28044`	6.4 Medium	stealthcopter	Yes
2017-06-22 00:00	WP Rocket <= 2.10.3 - Local File Inclusion WP Rocket < 2.10.4	`CVE-2017-11658`	7.5 High	Paulos Yibelo	Yes

Showing 1–6 of 6 reports