teckel vulnerabilities and threats

The Minify HTML WordPress plugin up to version 2.1.12 contains a Cross-Site Request Forgery (CSRF) vulnerability due to missing or incorrect nonce validation in the 'minify_html_menu_options' function. This flaw allows unauthenticated attackers to potentially update plugin settings if they can trick an administrator into performing an action such as clicking a malicious link. The vulnerability has a CVSS score of 5.4, indicating medium severity. There is no information about an available patch or official fix at this time.

The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1.10. This is due to processing user-supplied input as a regular expression. This makes it possible for unauthenticated attackers to create comments that can cause catastrophic backtracking and break pages.