Unauthenticated Stored Cross-Site Scripting Vulnerability in Breeze Cache Plugin for WordPress
CVE-2026-10551
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 13 July 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-10551?
The Breeze Cache plugin for WordPress is susceptible to unauthenticated Stored Cross-Site Scripting (XSS). This vulnerability arises from a predictable replacement hash utilized during the HTML minification process, allowing malicious actors to exploit a regular expression flaw. As a result, attackers can inject arbitrary HTML attributes into the final HTML output by guessing the placeholder format, potentially compromising site security and user data.
Affected Version(s)
Breeze Cache 0 < 2.5.6
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.