What is the CVSS score of CVE-2026-3220?

CVE-2026-3220 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Autoptimize are affected by CVE-2026-3220?

WordPress sites running Autoptimize, Clearfy Cache, or Speed Optimizer are vulnerable to unauthenticated injection attacks that could compromise all site visitors and damage organizational…. A patch is available.

Is there a public PoC exploit available for CVE-2026-3220?

Yes, a public proof-of-concept exploit is available for CVE-2026-3220. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-3220?

Within 24 hours, conduct an audit to identify all WordPress instances using Autoptimize (before version 3.1.15), Clearfy Cache (before version 2.4.2), or Speed Optimizer (before version 7.7.9), and prioritize production environments. Within 7 days, deploy vendor patches to all affected systems by upgrading to Autoptimize 3.1.15 or later, Clearfy Cache 2.4.2 or later, and Speed Optimizer 7.7.9 or later. Within 30 days, verify patch deployment with evidence of completion across all environments, conduct a forensic review for indicators of prior exploitation, and implement a quarterly plugin update cadence.

Autoptimize CVE-2026-3220

EUVD-2026-30736 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-18 WPScan

GHSA-3jpv-pgxw-p274

WordPress XSS Autoptimize Clearfy Cache Speed Optimizer Unknown

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

vuln.today AI

6.1 MEDIUM

Unauthenticated network injection via a predictable hash (PR:N, AC:L) that only fires when a victim views the page (UI:R); XSS crosses into the browser authority (S:C) with typical low confidentiality/integrity impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 18:04 vuln.today

Patch available

May 18, 2026 - 09:01 EUVD

CVE Published

May 18, 2026 - 06:00 cve.org

HIGH 8.8

CVE Published

May 18, 2026 - 06:00 nvd

UNKNOWN (no severity yet)

DescriptionCVE.org

The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.

AnalysisAI

Unauthenticated stored cross-site scripting affects the Autoptimize (before 3.1.15), Clearfy Cache (before 2.4.2), and Speed Optimizer (before 7.7.9) WordPress plugins, which share a common HTML-minification routine. Because the placeholder hash used to protect content during minification is predictable, an unauthenticated attacker who can get their input processed by the minifier can anticipate the placeholder format and inject arbitrary HTML attributes into the final rendered output. Publicly available exploit code exists (WPScan), a vendor patch is available, and EPSS is low (0.03%), but the impact is total per CISA SSVC; there is no public exploit identified as being used in active attacks.

Technical ContextAI

The vulnerability lives in the shared HTML minification engine used by these three WordPress optimization plugins. During minification, certain content is temporarily swapped out for placeholder tokens and restored afterward; here those tokens are derived from a predictable replacement hash rather than an unguessable secret. Combined with a permissive/abusable regular expression used to match and restore placeholders, an attacker who understands the deterministic placeholder format can craft input that, once reassembled into the minified page, escapes into live HTML attribute context. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) failure, but the root cause is specifically the predictability of the tokenization scheme rather than a missing output-encoding call. The CPE data (cpe:2.3:a:unknown:autoptimize, :clearfy_cache, :speed_optimizer) confirms the three affected code bases, and the shared behavior strongly implies common upstream minification logic.

RemediationAI

Apply the vendor patches by upgrading each plugin to its fixed release: Autoptimize to 3.1.15 or later, Clearfy Cache to 2.4.2 or later, and Speed Optimizer to 7.7.9 or later (Patch available per vendor advisory; consult the WPScan advisory at https://wpscan.com/vulnerability/3ceabf11-23cd-4c38-ba14-014348b0ff2d/ and NVD at https://nvd.nist.gov/vuln/detail/CVE-2026-3220). If you cannot patch immediately, the most direct compensating control is to disable the HTML minification feature within the affected plugin's settings, which removes the vulnerable placeholder-substitution path at the cost of losing HTML minification performance benefits (CSS/JS optimization can remain enabled). As additional hardening, place the site behind a WAF with XSS/HTML-injection rules and enable a restrictive Content-Security-Policy to limit script execution from injected markup - noting that a strict CSP may break inline scripts and require tuning, and that WAF rules can be bypassed and should not be treated as a substitute for the patch.