Docket Cache <= 26.04.09 - Reflected Cross-Site Scripting via 'nx' and 'nv' Parameters
- ID
- WPSEC-2026-1085
- Plugin
- Docket Cache – Object Cache Accelerator (docket-cache)
- Affected
- all versions before 26.04.10
- Remediation
- Update to 26.04.10 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-16
- Attack surface
- Docket Cache on WPSec AttackSurface
- Fix released
- Published
Description
The Docket Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nx' and 'nv' parameters in all versions up to, and including, 26.04.09, due to insufficient input sanitization and output escaping. On the plugin's Config and Log tabs, View::code_focus() placed the 'nx' value, filtered only by sanitize_text_field(), inside a JavaScript string in an inline script, so a double quote could close the string. The same script also added the admin notice's text, which can include the 'nv' value, back into the page as raw HTML. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute in an administrator's browser if they can trick the administrator into clicking a crafted link.
References
- https://wpsec.com/vuln/WPSEC-2026-1085/
- https://plugins.svn.wordpress.org/docket-cache/tags/26.04.10/
- https://wordpress.org/plugins/docket-cache/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS