HomeWordPress vulnerabilitiesBreeze Cache
Breeze Cache vulnerabilities
Breeze Cache has 7 known vulnerabilities in this database. The most recent published record is dated 18 Sep 2026.
- Known vulnerabilities
- 7
- Active installs
- 300,000+
- Latest version
- 2.6.0
- Last updated
- 29 Sep 2026
- Most recent
- 18 Sep 2026
Find it in your WordPress dashboard under Plugins. Severity is based on the CVSS score published with the CVE where one is available.
| Vulnerability | Severity | Affected | Fix | Published |
|---|---|---|---|---|
| Security weakness CVE-2026-79713 | Medium 6.5 | Before 2.5.15 | Fixed in 2.5.15 | 18 Sep 2026 |
| Arbitrary file upload CVE-2026-79706 | Medium 5.3 | Before 2.5.13 | Fixed in 2.5.13 | 28 Aug 2026 |
| Cross-site scripting (XSS) CVE-2026-10551 | Medium 6.1 | Before 2.5.6 | Fixed in 2.5.6 | 13 Jul 2026 |
| Broken access control CVE-2026-2128 | Medium 5.3 | Up to 2.5.2 | Fixed in a later version (latest 2.6.0) | 29 May 2026 |
| Remote code execution CVE-2026-3844 | Critical 9.8 | Up to 2.4.4 | Fixed in a later version (latest 2.6.0) | 23 Apr 2026 |
| Broken access control CVE-2025-13864 | Medium 5.3 | Up to 2.2.21 | Fixed in a later version (latest 2.6.0) | 19 Feb 2026 |
| Cross-site scripting (XSS) CVE-2022-29444 | Medium 6.5 | Before 2.0.3 | Fixed in 2.0.3 | 2 May 2022 |
Read the published descriptions
- CVE-2026-79713, 18 Sep 2026
- The Breeze Cache WordPress plugin before 2.5.15 does not include a set of tracking-related query parameters in its page-cache key while still caching pages requested with them, allowing unauthenticated attackers to have a page rendered under their own request context stored under, and served from, the clean URL's cache entry to every subsequent visitor. CVE record
- CVE-2026-79706, 28 Aug 2026
- The Breeze Cache WordPress plugin before 2.5.13 does not sanitise a value taken from the request before using it to build the paths of the files it caches, allowing unauthenticated attackers to create files at arbitrary locations on the server, outside the intended cache directory. CVE record
- CVE-2026-10551, 13 Jul 2026
- The Breeze Cache WordPress plugin before 2.5.6 is vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format. CVE record
- CVE-2026-2128, 29 May 2026
- The Breeze plugin for WordPress is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor in all versions up to, and including, 2.5.2 This is due to improper verification of the `wordpress_logged_in_` cookie in the `inc/cache/execute-cache.php` file when the "Cache Logged-in Users" setting is enabled. The plugin parses the username directly from the cookie value (e.g., `username|hash`) using `substr()` to retrieve the corresponding cache file but fails to verify the session's cryptographic signature or validity with WordPress core. This makes it possible for unauthenticated attackers to supply a crafted cookie (e.g., `wordpress_logged_in_fake=admin|fake`) to trick the plugin into serving the cached HTML content generated for an administrator, leading to the disclosure of sensitive information such as private posts (including their full content), the Admin Bar, WordPress nonces, and other data visible only to logged-in administrators or other users. CVE record
- CVE-2026-3844, 23 Apr 2026
- The Breeze Cache plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to, and including, 2.4.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible. The vulnerability can only be exploited if "Host Files Locally - Gravatars" is enabled, which is disabled by default. CVE record
- CVE-2025-13864, 19 Feb 2026
- The Breeze - WordPress Cache Plugin plugin for WordPress is vulnerable to unauthorized cache clearing in all versions up to, and including, 2.2.21. This is due to the REST API endpoint `/wp-json/breeze/v1/clear-all-cache` being registered with `permission_callback => '__return_true'` and authentication being disabled by default when the API is enabled. This makes it possible for unauthenticated attackers to clear all site caches (page cache, Varnish, and Cloudflare) via a simple POST request, granted the administrator has enabled the API integration feature. CVE record
- CVE-2022-29444, 2 May 2022
- Plugin Settings Change leading to Cross-Site Scripting (XSS) vulnerability in Cloudways Breeze plugin <= 2.0.2 on WordPress allows users with a subscriber or higher user role to execute any of the wp_ajax_* actions in the class Breeze_Configuration which includes the ability to change any of the plugin's settings including CDN setting which could be further used for XSS attack. CVE record
What to do if you run Breeze Cache
If you run Breeze Cache, open WordPress and check the installed version in Plugins. Compare it with the affected versions in the vulnerability record. If a fixed version is available, take a current backup and update to that version or the latest supported release.
If no fixed version exists, consider disabling and removing the plugin or replacing it with a maintained alternative. After dealing with the affected software, check administrator users, unexpected file changes, redirects, unfamiliar pages and security logs for signs that the site may already have been altered.
Email me about new Breeze Cache vulnerabilities
Free. We email you when a new vulnerability is published for Breeze Cache, usually within minutes. Confirm by email; unsubscribe any time.
Focus on your business. We’ll take care of your website.
From everyday updates to ongoing care, we keep your website working.