high8.8
CVE-2026-3220
The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to un…
Impact
The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
Affected products
| Product | Affected versions |
|---|---|
| Autoptimize WordPress Plugin | before 3.1.15 |
| Clearfy Cache WordPress Plugin | before 2.4.2 |
| Speed Optimizer WordPress Plugin | before 7.7.9 |
Versions were read from the advisory text. No structured product data has been published for this record yet.