Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?BreezeBreeze CheckoutBreeze Display
Plugin · breeze
Breeze
13 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 18, 2026Breeze Cache: Does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with themCVE-2026-79713 · fixed in 2.5.15 · reported by WPScanMedium 6.5
The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
Aug 28, 2026Breeze Cache: Does not sanitise a value taken from the request before using it to build the paths of the files it cachesCVE-2026-79706 · fixed in 2.5.13 · reported by WPScanMedium 5.3
The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.
Aug 18, 2026Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.CVE-2026-73356 · affects up to 2.5.12 · reported by PatchstackHigh 8.2
Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
Jul 13, 2026Breeze Cache: Is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expressionCVE-2026-10551 · fixed in 2.5.6 · reported by WPScanMedium 6.1
The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
May 29, 2026Breeze: Exposure of Sensitive Information to an Unauthorized ActorCVE-2026-2128 · affects up to 2.5.2 · reported by WordfenceMedium 5.3
The Breeze plugin for WordPress is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in all versions up to, and including, 2.5.2 This is due to improper verification of the `wordpress_logged_in_` cookie in the `inc/cache/execute-cache.php` file when the "Cache Logged-in Users" setting is enabled. The plugin parses the username directly from the cookie value (e.g., `username|hash`) using `substr()` to retrieve the corresponding cache file but fails to verify the session's cryptographic signature or validity with WordPress core. This makes it possible for unauthenticated attackers to supply a crafted cookie (e.g., `wordpress_logged_in_fake=admin|fake`) to trick the plugin into serving the cached HTML content generated for an administrator, leading to the disclosure of sensitive information such as private posts (including their full content), the Admin Bar, WordPress nonces, and other data visible only to logged-in administrators or other users.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 22, 2026Breeze Cache: Arbitrary file uploadsCVE-2026-3844 · affects up to 2.4.4 · reported by WordfenceCritical 9.8
The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026Breeze - WordPress Cache: Unauthorized cache clearingCVE-2025-13864 · affects up to 2.2.21 · reported by WordfenceMedium 5.3
The Breeze - WordPress Cache Plugin plugin for WordPress is vulnerable to unauthorized cache clearing in all versions up to, and including, 2.2.21. This is due to the REST API endpoint `/wp-json/breeze/v1/clear-all-cache` being registered with `permission_callback => '__return_true'` and authentication being disabled by default when the API is enabled. This makes it possible for unauthenticated attackers to clear all site caches (page cache, Varnish, and Cloudflare) via a simple POST request, granted the administrator has enabled the API integration feature.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 6, 2026Breeze: Missing AuthorizationCVE-2025-69364 · affects up to 2.2.21 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.21.
Jun 18, 2025Breeze: Missing AuthorizationCVE-2025-23999 · affects up to 2.2.13 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.13.
Oct 29, 2024Breeze: Missing AuthorizationCVE-2024-50422 · affects up to 2.1.14 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.1.14.
Oct 28, 2024Breeze: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50431 · affects up to 2.1.14 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze allows Stored XSS.This issue affects Breeze: from n/a through <= 2.1.14.
Mar 27, 2024Breeze: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27188 · affects up to 2.1.3 · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze.This issue affects Breeze: from n/a through <= 2.1.3.
May 2, 2022Cloudways Breeze plugin <= 2.0.2 on: Plugin Settings Change leading to Cross-Site Scripting (XSS)CVE-2022-29444 · affects up to 2.0.2 · reported by PatchstackMedium 6.5
Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Configuration which includes the ability to change any of the plugin's settings including CDN setting which could be further used for XSS attack.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.