Clearfy Cache
Monthly
Unauthenticated stored cross-site scripting affects the Autoptimize (before 3.1.15), Clearfy Cache (before 2.4.2), and Speed Optimizer (before 7.7.9) WordPress plugins, which share a common HTML-minification routine. Because the placeholder hash used to protect content during minification is predictable, an unauthenticated attacker who can get their input processed by the minifier can anticipate the placeholder format and inject arbitrary HTML attributes into the final rendered output. Publicly available exploit code exists (WPScan), a vendor patch is available, and EPSS is low (0.03%), but the impact is total per CISA SSVC; there is no public exploit identified as being used in active attacks.
Open redirect in Clearfy Cache WordPress plugin (versions before 2.4.3) allows unauthenticated attackers to redirect site visitors to arbitrary external URLs by exploiting the Cyrlitera old-URL redirect handler, which passes a decoded request URI to an unsafe redirect function without target validation. Exploitation requires that the non-default Cyrlitera redirect option is enabled on the target site, and a victim must interact with an attacker-crafted URL. No public KEV listing exists, EPSS sits at the 4th percentile (0.14%), but a publicly available proof-of-concept has been published by WPScan.
Clearfy Cache WordPress plugin versions before 2.4.3 exposes admin-only settings pages and their contents - including administrative nonces - to any authenticated user at Subscriber level or above due to a missing capability check on an alternate admin-page dispatch path. While the canonical admin URL enforces access controls correctly, the unguarded dispatch path bypasses those restrictions entirely. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.13% (3rd percentile), indicating low observed exploitation probability despite POC availability; no confirmed active exploitation (CISA KEV) has been recorded.
PHP Object Injection in Clearfy Cache WordPress plugin (versions before 2.4.3) exposes administrator-authenticated users to potential remote code execution through unrestricted deserialization during settings import. The plugin's import handler passes attacker-controlled serialized data to PHP's unserialize() without class whitelisting, enabling object injection. A publicly available POC exists via WPScan, though RCE is conditional on a suitable gadget chain being present in the WordPress environment; EPSS is low (0.21%, 12th percentile) and no CISA KEV listing has been issued, indicating no confirmed widespread exploitation.
Unauthenticated stored cross-site scripting affects the Autoptimize (before 3.1.15), Clearfy Cache (before 2.4.2), and Speed Optimizer (before 7.7.9) WordPress plugins, which share a common HTML-minification routine. Because the placeholder hash used to protect content during minification is predictable, an unauthenticated attacker who can get their input processed by the minifier can anticipate the placeholder format and inject arbitrary HTML attributes into the final rendered output. Publicly available exploit code exists (WPScan), a vendor patch is available, and EPSS is low (0.03%), but the impact is total per CISA SSVC; there is no public exploit identified as being used in active attacks.
Open redirect in Clearfy Cache WordPress plugin (versions before 2.4.3) allows unauthenticated attackers to redirect site visitors to arbitrary external URLs by exploiting the Cyrlitera old-URL redirect handler, which passes a decoded request URI to an unsafe redirect function without target validation. Exploitation requires that the non-default Cyrlitera redirect option is enabled on the target site, and a victim must interact with an attacker-crafted URL. No public KEV listing exists, EPSS sits at the 4th percentile (0.14%), but a publicly available proof-of-concept has been published by WPScan.
Clearfy Cache WordPress plugin versions before 2.4.3 exposes admin-only settings pages and their contents - including administrative nonces - to any authenticated user at Subscriber level or above due to a missing capability check on an alternate admin-page dispatch path. While the canonical admin URL enforces access controls correctly, the unguarded dispatch path bypasses those restrictions entirely. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.13% (3rd percentile), indicating low observed exploitation probability despite POC availability; no confirmed active exploitation (CISA KEV) has been recorded.
PHP Object Injection in Clearfy Cache WordPress plugin (versions before 2.4.3) exposes administrator-authenticated users to potential remote code execution through unrestricted deserialization during settings import. The plugin's import handler passes attacker-controlled serialized data to PHP's unserialize() without class whitelisting, enabling object injection. A publicly available POC exists via WPScan, though RCE is conditional on a suitable gadget chain being present in the WordPress environment; EPSS is low (0.21%, 12th percentile) and no CISA KEV listing has been issued, indicating no confirmed widespread exploitation.