CVE-2026-3220: Unknown Autoptimize

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format.

Affected products

• Unknown Autoptimize: before 3.1.15 (fixed in 3.1.15)
• Unknown Clearfy Cache: before 2.4.2 (fixed in 2.4.2)
• Unknown Speed Optimizer: before 7.7.9 (fixed in 7.7.9)

Published 2026-05-18. Last modified 2026-06-17.