WordPress Plugin Vulnerabilities
Multiple Plugins - Unauthenticated Stored XSS via Minify Library
Description
The plugins are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
Proof of Concept
Affects Plugins
Fixed in 3.1.15 References
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Matthew Rollings
Submitter
Matthew Rollings
Submitter website
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-04-27 (about 16 days ago)
Added
2026-04-27 (about 16 days ago)
Last Updated
2026-05-08 (about 4 days ago)
WPScan 