CVE-2026-10551

MediumCVSS 6.1

Published: 13/07/2026(UTC)Updated: 13/07/2026(UTC)Translated: 14/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

The Breeze Cache WordPress plugin before version 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS). This is due to a predictable replacement hash used during HTML minification and abuse of a regular expression, allowing an attacker to inject arbitrary HTML attributes into the final output.

Risk Assessment

An attacker can inject malicious JavaScript that executes in visitors' browsers, leading to session theft, redirects, or data theft.

Recommendation

Immediately update the Breeze Cache plugin to version 2.5.6 or later, which fixes this vulnerability.

Other vulnerabilities in Breeze Cache

CVE-2026-79713Medium
The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.

Original NVD description (English source)

The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS