The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Autoptimize Plugin | — | Update autoptimize plugin to version 3.1.15, or a newer patched version | Jul 31, 2026 | Apr 27, 2026 |
| Clearfy Plugin | — | Update clearfy plugin to version 2.4.2, or a newer patched version | Jul 31, 2026 | Apr 27, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub