Executive brief
Multiple popular WordPress optimization plugins are vulnerable to a security flaw that allows attackers to inject malicious scripts into a website. These plugins, used to speed up websites by compressing code, contain a logic error that lets an unauthenticated user bypass security filters. If exploited, an attacker could take over administrative accounts, steal visitor data, or deface the website.
Technical details
The vulnerability exists in the HTML minification logic shared across multiple WordPress plugins (Autoptimize, Clearfy Cache, and Speed Optimizer). The root cause is the use of a predictable replacement hash and a flawed regular expression during the minification process. An unauthenticated attacker can anticipate the placeholder format used for minification to inject arbitrary HTML attributes and malicious JavaScript into the final rendered page. This results in Stored Cross-Site Scripting (XSS) that executes in the context of any user viewing the affected pages. Patches are available in Autoptimize 3.1.15, Clearfy 2.4.2, and Speed Optimizer 7.7.9.
Affected products
- Autoptimize Autoptimize < 3.1.15
- Clearfy Clearfy Cache < 2.4.2
- SiteGround Speed Optimizer (sg-cachepress) < 7.7.9
Timeline
- 2026-04-27: disclosed: Publicly published by researcher
- 2026-05-18: advisory: NVD publication date