CVE-2025-11706: Aruba HiSpeed Cache <= 3.0.2 - Reflected Cross-Site Scripting
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the dbstatus parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-11706?
CVE-2025-11706 has a medium severity rating due to the reflected cross-site scripting vulnerability in Aruba HiSpeed Cache.
How do I fix CVE-2025-11706?
To fix CVE-2025-11706, update Aruba HiSpeed Cache to version 3.0.3 or later to ensure proper input sanitization and output escaping.
What types of attacks can CVE-2025-11706 enable?
CVE-2025-11706 can enable attackers to perform reflected cross-site scripting attacks, potentially leading to data theft or session hijacking.
Which versions of Aruba HiSpeed Cache are affected by CVE-2025-11706?
CVE-2025-11706 affects all versions of Aruba HiSpeed Cache up to and including 3.0.2.
Is it safe to use Aruba HiSpeed Cache version 3.0.2?
No, using Aruba HiSpeed Cache version 3.0.2 is not safe due to the reflected cross-site scripting vulnerability identified as CVE-2025-11706.