Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Sep 18, 2026Breeze Cache: Does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with themCVE-2026-79713 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor.
- Product
- Breeze Cache
- Fixed in
- 2.5.15
- What to do
- Update Breeze Cache to 2.5.15 or newer.
Aug 28, 2026Breeze Cache: Does not sanitise a value taken from the request before using it to build the paths of the files it cachesCVE-2026-79706 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory.
- Product
- Breeze Cache
- Fixed in
- 2.5.13
- What to do
- Update Breeze Cache to 2.5.13 or newer.
Aug 18, 2026Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.CVE-2026-73356 · WordPress plugins & themes · reported by PatchstackHigh 8.2
Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
- Affected
- up to 2.5.12
- What to do
- Affects up to 2.5.12. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jul 13, 2026Breeze Cache: Is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expressionCVE-2026-10551 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
- Product
- Breeze Cache
- Fixed in
- 2.5.6
- What to do
- Update Breeze Cache to 2.5.6 or newer.
May 29, 2026Breeze: Exposure of Sensitive Information to an Unauthorized ActorCVE-2026-2128 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Breeze plugin for WordPress is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in all versions up to, and including, 2.5.2 This is due to improper verification of the `wordpress_logged_in_` cookie in the `inc/cache/execute-cache.php` file when the "Cache Logged-in Users" setting is enabled. The plugin parses the username directly from the cookie value (e.g., `username|hash`) using `substr()` to retrieve the corresponding cache file but fails to verify the session's cryptographic signature or validity with WordPress core. This makes it possible for unauthenticated attackers to supply a crafted cookie (e.g., `wordpress_logged_in_fake=admin|fake`) to trick the plugin into serving the cached HTML content generated for an administrator, leading to the disclosure of sensitive information such as private posts (including their full content), the Admin Bar, WordPress nonces, and other data visible only to logged-in administrators or other users.
- Product
- Breeze
- Affected
- up to 2.5.2
- What to do
- Affects up to 2.5.2. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Apr 22, 2026Breeze Cache: Arbitrary file uploadsCVE-2026-3844 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default.
- Product
- Breeze Cache
- Affected
- up to 2.4.4
- What to do
- Affects up to 2.4.4. Update Breeze Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 19, 2026Breeze - WordPress Cache: Unauthorized cache clearingCVE-2025-13864 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Breeze - WordPress Cache Plugin plugin for WordPress is vulnerable to unauthorized cache clearing in all versions up to, and including, 2.2.21. This is due to the REST API endpoint `/wp-json/breeze/v1/clear-all-cache` being registered with `permission_callback => '__return_true'` and authentication being disabled by default when the API is enabled. This makes it possible for unauthenticated attackers to clear all site caches (page cache, Varnish, and Cloudflare) via a simple POST request, granted the administrator has enabled the API integration feature.
- Product
- Breeze - WordPress Cache
- Affected
- up to 2.2.21
- What to do
- Affects up to 2.2.21. Update Breeze - WordPress Cache to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 6, 2026Breeze: Missing AuthorizationCVE-2025-69364 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.21.
- Product
- Breeze
- Affected
- up to 2.2.21
- What to do
- Affects up to 2.2.21. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 22, 2025Breeze Checkout: Missing AuthorizationCVE-2025-49961 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Breeze Team Breeze Checkout breeze-checkout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze Checkout: from n/a through <= 1.4.0.
- Product
- Breeze Checkout
- Affected
- up to 1.4.0
- What to do
- Affects up to 1.4.0. Update Breeze Checkout to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jun 18, 2025Breeze: Missing AuthorizationCVE-2025-23999 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.13.
- Product
- Breeze
- Affected
- up to 2.2.13
- What to do
- Affects up to 2.2.13. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 24, 2025Breeze Display: Stored Cross-Site ScriptingCVE-2025-3749 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Breeze Display plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘cal_size’ parameter in all versions up to, and including, 1.2.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Product
- Breeze Display
- Affected
- up to 1.2.3
- What to do
- Affects up to 1.2.3. Update Breeze Display to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 29, 2024Breeze: Missing AuthorizationCVE-2024-50422 · WordPress plugins & themes · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.1.14.
- Product
- Breeze
- Affected
- up to 2.1.14
- What to do
- Affects up to 2.1.14. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Oct 28, 2024Breeze: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-50431 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze allows Stored XSS.This issue affects Breeze: from n/a through <= 2.1.14.
- Product
- Breeze
- Affected
- up to 2.1.14
- What to do
- Affects up to 2.1.14. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 27, 2024Breeze: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2024-27188 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze.This issue affects Breeze: from n/a through <= 2.1.3.
- Product
- Breeze
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Breeze to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
May 2, 2022Cloudways Breeze plugin <= 2.0.2 on: Plugin Settings Change leading to Cross-Site Scripting (XSS)CVE-2022-29444 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Configuration which includes the ability to change any of the plugin's settings including CDN setting which could be further used for XSS attack.
- Product
- Cloudways Breeze plugin <= 2.0.2 on
- Affected
- up to 2.0.2
- What to do
- Affects up to 2.0.2. Update Cloudways Breeze plugin <= 2.0.2 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.comwordpress.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.