CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1.10. This is due to processing user-supplied input as a regular expression. This makes it possible for unauthenticated attackers to create comments that can cause catastrophic backtracking and break pages.
Explanation of Vulnerability in Simple Terms
Teckel Minify HTML versions 2.1.10 and earlier allow an attacker to modify HTML content on the site without authentication. The vulnerability stems from insufficient input validation when processing HTML minification requests. An attacker can inject malicious HTML or alter existing page content, potentially affecting site integrity and user trust.
What an attacker can do
Modify or inject HTML content on the site without needing to log in.
Potential impact on your site
Site visitors may see altered or injected HTML content, compromising page integrity and potentially enabling phishing or malware distribution.
Conditions required to exploit
Network access to the site; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
