Threat Entry Updated 2026-04-01

CVE-2026-3191 - Minify Html Plugin

The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due to missing or incorrect nonce validation on the 'minify_html_menu_options' function. This makes it possible for unauthenticated attackers to update plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PLUGIN Minify Html

CVE-2026-3191

MEDIUM CVSS 5.4 2026-03-31

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2024-12-13

CVE-2024-12579 - Minify Html Plugin

The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1.10. This is due to processing user-supplied input as a regular expression. This makes it possible for unauthenticated attackers to create comments that can cause catastrophic backtracking and break pages.

PLUGIN Minify Html

CVE-2024-12579

MEDIUM CVSS 5.3 2024-12-13

Risk Score

Open Full Technical Breakdown