Cache Poisoning and Stored Cross-Site Scripting in WP Supercache

WP Super Cache stores the CDN URL and CNAME settings unescaped and substitutes them into the src/href attribute of every rewritten asset URL, so a value containing a quote or an angle bracket breaks out of the attribute and executes script for every visitor. String settings and direct-page paths are written to the cache config file as raw PHP...