EUVD-2026-43283
GHSA-m7gw-pmv8-8hf3
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Unauthenticated network attack with low complexity; scope change reflects browser-context impact on victim; no server confidentiality or availability impact applies.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
AnalysisAI
Stored Cross-Site Scripting in the Breeze Cache WordPress plugin (versions before 2.5.6) allows unauthenticated attackers to inject arbitrary HTML attributes into cached page output by exploiting a predictable placeholder hash format used during HTML minification. The root cause is a weak, guessable replacement token generated during the minification pipeline combined with a flawed regular expression, meaning an attacker who can submit content to the site can anticipate the placeholder pattern and craft input that survives minification as injected markup. A publicly available proof-of-concept exploit exists; this vulnerability has not been confirmed in CISA KEV at time of analysis, but the low attack complexity and unauthenticated access requirement make it a realistic opportunistic target across WordPress deployments using this plugin.
Technical ContextAI
Breeze Cache is a WordPress caching plugin, associated primarily with Cloudways-hosted WordPress environments, that performs HTML minification as part of its page caching pipeline. During minification, the plugin temporarily replaces certain HTML constructs with placeholder tokens - hashes or tokens intended to protect content through transformation. The vulnerability arises because these replacement hashes are predictable in format, allowing an attacker who understands the plugin's placeholder generation logic to craft input that is designed to survive the minification round-trip and emerge as injected HTML attributes in the final cached output. This is compounded by a flawed regular expression that fails to sanitize or properly escape attacker-controlled strings. The affected CPE is cpe:2.3:a:unknown:breeze_cache:*:*:*:*:*:*:*:*, covering all versions prior to 2.5.6. No CWE identifier was formally assigned in the available data, but the root cause class is improper neutralization of input during web page generation (functionally equivalent to CWE-79) combined with a predictable value / weak token generation flaw (functionally equivalent to CWE-340).
RemediationAI
Upgrade the Breeze Cache WordPress plugin to version 2.5.6 or later, which contains the vendor-released patch addressing the predictable hash and regular expression flaws. The fix is confirmed available per vendor advisory at https://wpscan.com/vulnerability/381fb82f-2fdc-49cb-bb0d-8d70ead61d86/. If immediate upgrade is not possible, disabling the HTML minification feature within the Breeze Cache plugin settings will eliminate the vulnerable code path - this trades page performance optimization for security and may slightly increase page load times. Alternatively, temporarily deactivating the Breeze Cache plugin entirely removes the attack surface at the cost of caching benefits. Site administrators should also audit cached pages and purge the full cache after patching to clear any already-injected content that may have been stored prior to remediation.
More in Breeze Cache
View allArbitrary file upload in Breeze Cache for WordPress allows unauthenticated remote attackers to upload malicious files an
Arbitrary file write in the Breeze Cache WordPress plugin (all versions before 2.5.13) allows unauthenticated remote att
Unauthenticated information disclosure in the Cloudways Breeze Cache plugin for WordPress (all versions ≤ 2.5.2) allows
Share
External POC / Exploit Code
Leaving vuln.today