CVE-2026-10551: Breeze Cache WordPress Plugin XSS Flaw

CVE-2026-10551 Overview

CVE-2026-10551 affects the Breeze Cache WordPress plugin in versions prior to 2.5.6. The plugin is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) caused by a predictable replacement hash generated during the HTML minification process. Attackers exploit the predictable placeholder format together with a permissive regular expression to inject arbitrary HTML attributes into cached page output. The injected content is then served to every visitor that receives the cached response, enabling script execution in the context of the affected site.

Critical Impact
Unauthenticated attackers can inject persistent HTML attributes into cached pages, resulting in stored XSS delivered to all site visitors.

Affected Products

Breeze Cache WordPress plugin versions prior to 2.5.6
WordPress sites using Breeze for HTML minification and page caching
Cached HTML output served by vulnerable Breeze installations

Discovery Timeline

2026-07-13 - CVE-2026-10551 published to the National Vulnerability Database (NVD)
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-10551

Vulnerability Analysis

The vulnerability lives in the HTML minification pipeline of the Breeze Cache plugin. During minification, Breeze temporarily replaces selected HTML fragments with placeholder tokens derived from a hash. The hash used for these placeholders is predictable, which allows an attacker to construct input that mimics the placeholder format. When Breeze later reverses the replacement, attacker-controlled content is substituted back into the final HTML as if it were trusted minifier output.

Because the flaw sits in cache generation, the injected payload becomes stored XSS. Any visitor requesting the cached URL receives the malicious HTML attributes without further attacker interaction. Successful exploitation permits session token theft, forced navigation, credential harvesting through injected forms, and defacement of rendered pages. The issue does not require authentication, which broadens the attack surface to any endpoint whose response Breeze caches.

Root Cause

The root cause is the use of a predictable replacement hash combined with an overly permissive regular expression that governs placeholder matching. Because both the placeholder format and the regex are known, an attacker can craft input that survives sanitization and later collides with the replacement routine. The minifier restores attacker input verbatim into the output HTML, producing an attribute-level injection primitive [CWE-79].

Attack Vector

The attack vector is network-based and requires user interaction only in the sense that a victim must load a cached page. An unauthenticated attacker submits crafted input to a request path that Breeze minifies and caches. Once the poisoned response is stored in the cache, every subsequent visitor to that URL receives the injected HTML attributes. Refer to the WPScan Vulnerability Report for technical details on the placeholder construction.

Detection Methods for CVE-2026-10551

Indicators of Compromise

Cached HTML responses containing unexpected on* event handler attributes or javascript: URIs in tag attributes
Presence of placeholder-like tokens or partial hash strings in served HTML that were not part of the original template
Anomalous outbound requests from browsers loading pages served by Breeze Cache, such as beacons to unfamiliar domains

Detection Strategies

Inventory WordPress sites and confirm the installed Breeze plugin version; flag any release prior to 2.5.6
Compare rendered HTML from cached responses against the source template to identify unauthorized attribute injections
Review web application firewall (WAF) logs for requests containing hash-like tokens or minifier placeholder patterns

Monitoring Recommendations

Alert on modifications to files under wp-content/cache/breeze/ that introduce script-capable HTML attributes
Monitor server access logs for repeated unauthenticated POSTs or comment submissions targeting cacheable endpoints
Track browser Content Security Policy (CSP) violation reports for unexpected inline event handlers on production pages

How to Mitigate CVE-2026-10551

Immediate Actions Required

Update the Breeze Cache plugin to version 2.5.6 or later on all WordPress installations
Purge the existing page cache after upgrading to remove any poisoned entries created before the patch
Audit user-generated content endpoints, including comments and form submissions, for evidence of prior injection

Patch Information

The vendor addressed CVE-2026-10551 in Breeze Cache version 2.5.6. The fix removes reliance on the predictable replacement hash used during HTML minification and tightens the regular expression that matches placeholder tokens. Administrators should apply the update through the WordPress plugin manager and validate the running version afterwards. Refer to the WPScan Vulnerability Report for the authoritative advisory.

Workarounds

Temporarily deactivate the Breeze Cache plugin until version 2.5.6 or later can be applied
Disable the HTML minification feature within Breeze settings while retaining other caching functionality
Deploy a WAF rule blocking request bodies that contain minifier placeholder patterns targeting cacheable endpoints

bash

# Configuration example: verify Breeze plugin version via WP-CLI
wp plugin get breeze --field=version
wp plugin update breeze --version=2.5.6
wp breeze purge --cache=all