CVE-2026-84934 JCH Optimize < 6.0.1 - Subscriber+ Stored XSS via getcacheinfo Task Override

The JCH Optimize WordPress plugin before 6.0.1 does not perform a capability check on one of its authenticated AJAX actions and lets the request choose which internal action runs, allowing any authenticated users such as Subscribers to import arbitrary JCH Optimize WordPress plugin before 6.0.1...

CVE-2026-84934

The JCH Optimize WordPress plugin versions before 6.0.1 is vulnerable to a Stored XSS vulnerability. The root cause is a missing capability check on an authenticated AJAX action, which allows the request to trigger unintended internal actions. Exploiting this, authenticated users with low privile...