Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 9

Export CSV
CVE-2026-73356

WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability

Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.

CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed
Vendors
Cloudways Wordpress
Products
Breeze Wordpress
CVE-2026-2128

Breeze Cache <= 2.5.2 - Unauthenticated Exposure of Sensitive Information to an Unauthorized Actor via Crafted Login Cookie

The Breeze plugin for WordPress is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in all versions up to, and including, 2.5.2 This is due to improper verification of the `wordpress_logged_in_` cookie in the `inc/cache/execute-cache.php` file when the "Cache Logged-in Users" setting is enabled. The plugin parses the username directly from the cookie value (e.g., `username|hash`) using `substr()` to retrieve the corresponding cache file but fails to verify the session's cryptographic signature or validity with WordPress core. This makes it possible for unauthenticated attackers to supply a crafted cookie (e.g., `wordpress_logged_in_fake=admin|fake`) to trick the plugin into serving the cached HTML content generated for an administrator, leading to the disclosure of sensitive information such as private posts (including their full content), the Admin Bar, WordPress nonces, and other data visible only to logged-in administrators or other users.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudways Wordpress
Products
Breeze Wordpress
CVE-2026-3844

Breeze Cache <= 2.4.4 - Unauthenticated Arbitrary File Upload via fetch_gravatar_from_remote

The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default.

CVSS 3.1 · 9.8 Critical EPSS 27.7% KEV · Not listed
Vendors
Cloudways Wordpress
Products
Breeze Wordpress
CVE-2025-69364

WordPress Breeze plugin <= 2.2.21 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.21.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudways Wordpress
Products
Breeze Wordpress
CVE-2024-50431

WordPress Breeze plugin <= 2.1.14 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze allows Stored XSS.This issue affects Breeze: from n/a through <= 2.1.14.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudways Wordpress
Products
Breeze Wordpress
CVE-2024-50422

WordPress Breeze plugin <= 2.1.14 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.1.14.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudways
Products
Breeze
CVE-2024-27188

WordPress Breeze plugin <= 2.1.3 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze.This issue affects Breeze: from n/a through <= 2.1.3.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudways Wordpress
Products
Breeze Wordpress
CVE-2025-13864

Breeze – WordPress Cache Plugin <= 2.2.21 - Missing Authorization to Cache Deletion

The Breeze - WordPress Cache Plugin plugin for WordPress is vulnerable to unauthorized cache clearing in all versions up to, and including, 2.2.21. This is due to the REST API endpoint `/wp-json/breeze/v1/clear-all-cache` being registered with `permission_callback => '__return_true'` and authentication being disabled by default when the API is enabled. This makes it possible for unauthenticated attackers to clear all site caches (page cache, Varnish, and Cloudflare) via a simple POST request, granted the administrator has enabled the API integration feature.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudways Wordpress
Products
Breeze Wordpress
CVE-2022-29444

WordPress Breeze plugin <= 2.0.2 - Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability

Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Configuration which includes the ability to change any of the plugin's settings including CDN setting which could be further used for XSS attack.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Cloudways
Products
Breeze