Security Advisory

CVE-2026-3220

CVE vulnerability detail - eXtreme Datacenter Security Operations

Published 2026-05-18 06:00:08

Last updated 2026-05-18 13:40:11

Assigner WPScan

CVSS score not scored

State PUBLISHED

Description

The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.

← Browse all CVEs View on cve.org ↗