What happened
CVE-2026-109985 (CWE-79, CVSS 6.4) is a stored cross-site scripting flaw in the xSpeed AI/MCP caching plugin: contributor-level users can inject arbitrary scripts that execute in the context of a user visiting the page.
Why it matters
This is an AI/MCP-adjacent WordPress plugin; the stored script can be used to hijack the admin session that manages the AI cache/MCP configuration and any provider credentials the plugin handles, turning content-level XSS into admin-level impact.
Attack vector
Authenticated attacker with contributor-level access injects arbitrary web scripts through the 'content' parameter due to insufficient input sanitization/output escaping; the stored XSS fires when any user visits the injected page.
Affected systems
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching & CDN (wpdevteam) through 1.4.2
Mitigation
Apply the patched changeset (WordPress plugin trac changeset 3749755) / upgrade beyond 1.4.2.