CVE-2026-10551

MediumCVSS 6.1/10Last modified Jul 13, 2026

Description

The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected software

VendorProductVersions
UnknownBreeze Cache< 2.5.6

References

Timeline

Published
Jul 13, 2026
Last modified
Jul 13, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1055107.0Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.CVE-2026-1055117.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Point-to-Point Protocol over EthernetCVE-2026-1055127.5Integer underflow (wrap or wraparound) in Microsoft QUIC allows an unauthorized attacker to deny service over a network.CVE-2026-1055137.0An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exCVE-2026-1055157.5Buffer over-read in Windows Message Queuing allows an unauthorized attacker to deny service over a network.CVE-2026-1055188.8Use after free in Windows iSCSI allows an unauthorized attacker to execute code over a network.CVE-2026-105524.3The Blue Captcha plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to and including 2.0.1. This is due to missCVE-2026-1055207.2Improper link resolution before file access ('link following') in Windows DNS allows an authorized attacker to elevate privileges over a netCVE-2026-1055227.0Use after free in Winlogon allows an authorized attacker to elevate privileges locally.CVE-2026-1055247.8Weak authentication in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.CVE-2026-1055257.0Integer overflow or wraparound in Windows Network Connection Broker allows an authorized attacker to elevate privileges locally.CVE-2026-1055267.0Double free in Winsock allows an authorized attacker to elevate privileges locally.
CVE-2026-10551: Medium severity, CVSS 6.1 | Vulnix