CVE-2026-10551 Breeze Cache CVE debrief

Who should care

Users of Breeze Cache WordPress plugin versions before 2.5.6, WordPress site administrators, security teams, and vulnerability management teams should be aware of this vulnerability and take necessary actions to protect their sites. The vulnerability has a high impact on affected systems, and defenders should prioritize patching or mitigating the vulnerability.

Technical summary

The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format. The vulnerability affects WordPress sites using the Breeze Cache plugin, and defenders should focus on updating the plugin to version 2.5.6 or later.

Defensive priority

High

Recommended defensive actions

• Update Breeze Cache WordPress plugin to version 2.5.6 or later
• Monitor for suspicious activity on your WordPress site
• Implement additional security measures such as Web Application Firewall (WAF) rules to detect and prevent XSS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is limited; verify vulnerability details with official sources and perform thorough testing before applying patches. The Breeze Cache WordPress plugin before 2.5.6 has a predictable replacement hash used during the HTML minification process, which can be exploited for unauthenticated Stored Cross-Site Scripting (XSS). Defenders should verify affected scope, review official advisories, and monitor for suspicious activity.

Official resources