{"id":"CVE-2026-10551","aliases":["EUVD-2026-43283","GHSA-m7gw-pmv8-8hf3"],"status":"published","title":"Breeze Cache \u003c 2.5.6 - Unauthenticated Stored XSS via Minify Library","description":"The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00253,"percentile":0.16932,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2026-07-13T06:00:01Z","modified":"2026-07-13T18:31:48Z","products":[{"vendor":"cloudways","product":"breeze cache"},{"vendor":"unknown","product":"breeze cache"}],"references":[{"url":"https://wpscan.com/vulnerability/381fb82f-2fdc-49cb-bb0d-8d70ead61d86/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-10551"},{"url":"https://wpscan.com/vulnerability/381fb82f-2fdc-49cb-bb0d-8d70ead61d86"},{"url":"https://github.com/advisories/GHSA-m7gw-pmv8-8hf3"}],"sources":{"cve":[{"id":"CVE-2026-10551","title":"Breeze Cache \u003c 2.5.6 - Unauthenticated Stored XSS via Minify Library","description":"The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.","status":"published","published":"2026-07-13T06:00:01.138Z","modified":"2026-07-13T15:54:20.284Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T13:40:01.309549Z"}],"euvd":[{"id":"EUVD-2026-43283","description":"The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.","status":"published","published":"2026-07-13T06:00:01Z","modified":"2026-07-13T15:54:20Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:01.519776Z"}],"ghsa":[{"id":"GHSA-m7gw-pmv8-8hf3","title":"The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site...","description":"The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.","status":"published","published":"2026-07-13T09:31:41Z","modified":"2026-07-13T18:31:48Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:09:25.900925Z"}],"nvd":[{"id":"CVE-2026-10551","description":"The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.","status":"published","published":"2026-07-13T07:16:26.2Z","modified":"2026-07-13T18:05:36.13Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"updated_at":"2026-11-02T14:12:28.771746Z"}]}}