Medium severity · published Feb 19, 2026
CVE-2025-11706
Aruba HiSpeed Cache <= 3.0.2 - Reflected Cross-Site Scripting
6.1
CVSS
0.3%
EPSS
No
On KEV
Description
The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the dbstatus parameter in all versions up to, and including, 3.0.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 27% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AH
Aruba HiSpeed Cache · arubadev
through 3.0.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-11706
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-11706
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/aruba-hispeed-cache/tags/3.0.1/aruba-hispeed-cache.php#L635
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3399636%40aruba-hispeed-cache&new=3399636%40aruba-hispeed-cache&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/3d4bb4b6-9565-4a8a-aae3-ba863ef42ddb?source=cve
More from Aruba HiSpeed Cache
6.5
CVE-2025-11725
Aruba HiSpeed Cache <= 3.0.2 - Missing Authorization to Unauthenticated Plugin's Settings Modification
6.4
CVE-2026-15889
Aruba HiSpeed Cache <= 3.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
4.3
CVE-2026-1924
Aruba HiSpeed Cache <= 3.0.4 - Cross-Site Request Forgery to Plugin Settings Reset