Executive brief
The Breeze Cache WordPress plugin caches web pages to improve performance, but fails to account for certain tracking-related query parameters when creating cache keys. This allows attackers to inject malicious content into cached pages that is then served to all subsequent site visitors. If the injected tracking parameter is reflected in the page content (for example, in an analytics field), visitors could be exposed to stored malicious scripts affecting their browsers.
Technical details
The vulnerability is a cache poisoning flaw caused by the plugin failing to include tracking-related query parameters (such as analytics campaign IDs) in its page-cache key while still caching pages requested with those parameters. An unauthenticated attacker can request a page with a malicious tracking parameter, causing that poisoned response to be cached and served under the clean URL cache entry to all subsequent visitors. When the tracking parameter is reflected in the page HTML (via another component), this escalates to a stored Cross-Site Scripting (XSS) vulnerability affecting every visitor. The vulnerability affects Breeze Cache versions 1.2.5 through 2.5.14 and is fixed in version 2.5.15.
Affected products
- Automattic Breeze Cache 1.2.5 to 2.5.14
Timeline
- 2026-09-16: disclosed
- 2026-09-18: patched: Fixed in version 2.5.15