Breeze Cache <= 2.5.17 - Authenticated (Contributor+) Stored Cross-Site Scripting via Lazy Load Image Attributes
- ID
- WPSEC-2026-0264
- Plugin
- Breeze Cache (breeze)
- Affected
- from 2.0.22 before 2.5.18
- Remediation
- Update to 2.5.18 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Breeze Cache on WPSec AttackSurface
- Fix released
- Published
Description
The Breeze Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the lazy-load rewriting of img tags in versions 2.0.22 up to, and including, 2.5.17. The regular expressions that extract an image's src and class values did not require the closing quote to match the opening one, and the extracted values were re-inserted as new attributes without escaping, so a quote character inside an attribute value could split it and turn the remainder into new attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the JavaScript (non-native) lazy-load option to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-0264/
- https://plugins.svn.wordpress.org/breeze/tags/2.5.18/
- https://wordpress.org/plugins/breeze/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS