WordPress CVEs

Description

The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.

Affected WordPress components

• Autoptimize Plugin · autoptimize
  Confirmed match Active
  Before 3.1.15
  View on WordPress.org
• Clearfy Cache – WordPress optimization plugin, Minify HTML, CSS & JS, Defer Plugin · clearfy
  Confirmed match Active
  Before 2.4.2
  View on WordPress.org
• Speed Optimizer – The All-In-One Performance-Boosting Plugin Plugin · sg-cachepress
  Confirmed match Active
  Before 7.7.9
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• Unknown Autoptimize — Before 3.1.15
• Unknown Clearfy Cache — Before 2.4.2
• Unknown Speed Optimizer — Before 7.7.9

References

• wpscan.com https://wpscan.com/vulnerability/3ceabf11-23cd-4c38-ba14-014348b0ff2d/
• nvd.nist.gov Official NVD record