Aller au contenu
en Se connecter
8.8 Élevée

CVE-2026-3220 The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress…

Description

The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.

Produits et versions touchés

Produit Versions touchées Corrigé en
Autoptimize 3.1 premières → < 3.1.15 3.1.15
Clearfy Cache 2.4 premières → < 2.4.2 2.4.2
Speed Optimizer 7.7 premières → < 7.7.9 7.7.9

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de Autoptimize

Les 8 CVE de Autoptimize →
CVE-2023-2113 The Autoptimize WordPress plugin before 3.1.7 does not sanitise and escape the settings imported from a previous export,… 4.8 Moyenne CVE-2022-4057 The Autoptimize WordPress plugin before 3.1.0 uses an easily guessable path to store plugin's exported settings and logs 5.3 Moyenne CVE-2022-2635 The Autoptimize WordPress plugin before 3.1.1 does not sanitise and escape some of its settings, which could allow… Non notée CVE-2021-24378 The Autoptimize WordPress plugin before 2.7.8 does not check for malicious files such as .html in the archive uploaded… Non notée
Suivre cette CVE