CVE-2026-3220

8.8 highEPSS 0.3%

High (8.8). EPSS 0.3% chance of exploitation in the next 30 days.

The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.

Severity

CVSS 3.1

8.8 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2026-05-18
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/3ceabf11-23cd-4c38-ba14-014348b0ff2d/

Check your stack JSON