Vulnerabilities and security researches forbreeze breeze
Direction: ascendingJun 07, 2024
Breeze – WordPress Cache Plugin # CVE-2024-27188
- CVE, Research URL
- Application
- Date
- Mar 27, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze.This issue affects Breeze: from n/a through <= 2.1.3.
- Affected versions
-
max 2.1.4.
- Status
-
vulnerable
Breeze – WordPress Cache Plugin # CVE-2022-29444
- CVE, Research URL
- Application
- Date
- May 03, 2022
- Research Description
- Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Configuration which includes the ability to change any of the plugin's settings including CDN setting which could be further used for XSS attack.
- Affected versions
-
max 2.0.3.
- Status
-
vulnerable
Oct 27, 2024
Breeze – WordPress Cache Plugin # CVE-2024-50422
- CVE, Research URL
- Application
- Date
- Oct 30, 2024
- Research Description
- Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.1.14.
- Affected versions
-
max 2.1.15.
- Status
-
vulnerable
Breeze – WordPress Cache Plugin # CVE-2024-50431
- CVE, Research URL
- Application
- Date
- Oct 29, 2024
- Research Description
- Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cloudways Breeze breeze allows Stored XSS.This issue affects Breeze: from n/a through <= 2.1.14.
- Affected versions
-
max 2.1.15.
- Status
-
vulnerable
Jul 03, 2025
Breeze – WordPress Cache Plugin # CVE-2025-23999
- CVE, Research URL
- Application
- Date
- Jun 18, 2025
- Research Description
- Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.13.
- Affected versions
-
max 2.2.14.
- Status
-
vulnerable
Jan 28, 2026
Breeze – WordPress Cache Plugin # CVE-2025-69364
- CVE, Research URL
- Application
- Date
- Jan 06, 2026
- Research Description
- Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.2.21.
- Affected versions
-
max 2.2.22.
- Status
-
vulnerable
Mar 29, 2026
Breeze – WordPress Cache Plugin # CVE-2025-13864
- CVE, Research URL
- Application
- Date
- Feb 19, 2026
- Research Description
- The Breeze - WordPress Cache Plugin plugin for WordPress is vulnerable to unauthorized cache clearing in all versions up to, and including, 2.2.21. This is due to the REST API endpoint `/wp-json/breeze/v1/clear-all-cache` being registered with `permission_callback => '__return_true'` and authentication being disabled by default when the API is enabled. This makes it possible for unauthenticated attackers to clear all site caches (page cache, Varnish, and Cloudflare) via a simple POST request, granted the administrator has enabled the API integration feature.
- Affected versions
-
max 2.2.22.
- Status
-
vulnerable
Apr 24, 2026
Breeze – WordPress Cache Plugin # CVE-2026-3844
- CVE, Research URL
- Application
- Date
- Apr 23, 2026
- Research Description
- The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default.
- Affected versions
-
max 2.4.5.
- Status
-
vulnerable
May 30, 2026
Breeze – WordPress Cache Plugin # CVE-2026-2128
- CVE, Research URL
- Application
- Date
- May 29, 2026
- Research Description
- The Breeze plugin for WordPress is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in all versions up to, and including, 2.5.2 This is due to improper verification of the `wordpress_logged_in_` cookie in the `inc/cache/execute-cache.php` file when the "Cache Logged-in Users" setting is enabled. The plugin parses the username directly from the cookie value (e.g., `username|hash`) using `substr()` to retrieve the corresponding cache file but fails to verify the session's cryptographic signature or validity with WordPress core. This makes it possible for unauthenticated attackers to supply a crafted cookie (e.g., `wordpress_logged_in_fake=admin|fake`) to trick the plugin into serving the cached HTML content generated for an administrator, leading to the disclosure of sensitive information such as private posts (including their full content), the Admin Bar, WordPress nonces, and other data visible only to logged-in administrators or other users.
- Affected versions
-
max 2.5.3.
- Status
-
vulnerable
Jun 16, 2026
Breeze – WordPress Cache Plugin # 9f8d98d070747dc4430a4d5893eedb992d889bf6
- CVE, Research URL
- Application
- Date
- Sep 19, 2022
- Research Description
- Breeze Cache [breeze] < 2.0.9 Breeze <= 2.0.8 - Cross-Site Request Forgery via import_json_settings The Breeze plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.8. This is due to missing or incorrect nonce validation on the 'import_json_settings' function. This makes it possible for unauthenticated attackers to import plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
- Affected versions
-
max 2.0.9.
- Status
-
vulnerable
Jul 15, 2026
Breeze – WordPress Cache Plugin # CVE-2026-10551
- CVE, Research URL
- Application
- Date
- Jul 13, 2026
- Research Description
- The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.
- Affected versions
-
max 2.5.6.
- Status
-
vulnerable
Aug 20, 2026
Breeze – WordPress Cache Plugin # CVE-2026-73356
- CVE, Research URL
- Application
- Date
- Aug 18, 2026
- Research Description
- Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
- Affected versions
-
max 2.5.13.
- Status
-
vulnerable
Aug 25, 2026
Breeze – WordPress Cache Plugin # PSC-2026-64687
- PSC, Research URL
- Application
- Date
- Aug 24, 2026
- Research Description
- Caching and optimization plugins rewrite responses, manage cache files, and interact with CDNs and remote asset sources. Breeze Cache version 2.5.13 has successfully completed the CleanTalk Plugin Security Certification process and received PSC-2026-64687, confirming that the review focused on cache storage, purge operations, optimization settings, remote downloads, administrator controls, and safe handling of generated assets.
- Affected versions
-
Min 2.5.13, max 2.5.13.
- Status
-
SAFE & CERTIFIED