CVE-2026-3220
Stored XSS in Autoptimize WordPress Plugin
Publication date: 2026-05-18
Last updated on: 2026-05-18
Assigner: WPScan
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| autoptimize | autoptimize | 3.1.15 |
| clearfy | clearfy | 2.4.2 |
| sg-cachepress | sg-cachepress | 7.7.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-3220 is a vulnerability affecting multiple WordPress plugins including Autoptimize, Clearfy Cache, and Speed Optimizer. It is an unauthenticated stored Cross-Site Scripting (XSS) flaw caused by a predictable replacement hash used during the HTML minification process combined with a flawed regular expression. This weakness allows an attacker to inject arbitrary HTML attributes into the final HTML output by anticipating the placeholder format used in the minification.
How can this vulnerability impact me? :
This vulnerability can have a high impact as it allows attackers to execute arbitrary HTML or script code in the context of the affected website without authentication. This can lead to theft of user data, session hijacking, defacement of the website, or distribution of malicious content. The CVSS score of 8.8 indicates a high severity, meaning the risk to confidentiality, integrity, and availability is significant.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, immediately update the affected WordPress plugins to their fixed versions:
- Update Autoptimize plugin to version 3.1.15 or later.
- Update Clearfy Cache plugin to version 2.4.2 or later.
- Update Speed Optimizer (sg-cachepress) plugin to version 7.7.9 or later.
These updates address the unauthenticated stored Cross-Site Scripting vulnerability caused by a predictable replacement hash and flawed regular expression during HTML minification.