Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4

Export CSV
CVE-2026-16295

Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher

The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Clearfy Cache Wordpress
Products
Clearfy Cache Wordpress
CVE-2026-16296

Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler

The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed
Vendors
Clearfy Cache Wordpress
Products
Clearfy Cache Wordpress
CVE-2026-16297

Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import

The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment.

CVSS 3.1 · 4.1 Medium EPSS < 1% KEV · Not listed
Vendors
Clearfy Cache Wordpress
Products
Clearfy Cache Wordpress
CVE-2026-3220

Multiple Plugins - Unauthenticated Stored XSS via Minify Library

The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Autoptimize Clearfy Cache Speed Optimizer and 1 more
Products
Autoptimize Clearfy Cache Speed Optimizer and 1 more