CVE-2026-10551 is a stored Cross-Site Scripting (XSS) vulnerability in the Breeze Cache WordPress plugin prior to version 2.5.6. The vulnerability stems from the use of a predictable replacement hash during the HTML minification process combined with a regular expression that can be abused. This flaw enables unauthenticated attackers to inject arbitrary HTML attributes into the rendered HTML, potentially leading to script execution in users' browsers.

Successful exploitation allows an unauthenticated attacker to inject arbitrary HTML attributes into the web pages served by the Breeze Cache plugin, which can lead to stored XSS attacks. This may result in the execution of malicious scripts in the context of users' browsers, potentially compromising user data, session tokens, or enabling further attacks. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the HTML minification feature or applying other temporary mitigations recommended by the vendor. Monitor the vendor's communications for updates and apply patches promptly once available.