Minify Html Markup Vulnerabilities

Cross-Site Request Forgery to Plugin Settings Update vulnerability

CVSS:

4.3

Affected:

up to 2.1.12

Fixed in:

2.1.13

Disclosed:

Mar 31, 2026

The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.12. This is due to missing or incorrect nonce validation on the 'minify_html_menu_options' function. This makes it possible for unauthenticated attackers to update plugin settings via a forged requ...

CVSS:

5.4

Affected:

up to 2.1.12

Fixed in:

2.1.13

Disclosed:

Mar 30, 2026

CVE-2026-3191 on NVD →

The Minify HTML plugin for WordPress is vulnerable to Regular Expression Denial of Service (ReDoS) in all versions up to, and including, 2.1.10. This is due to processing user-supplied input as a regular expression. This makes it possible for unauthenticated attackers to create comments that can cause catastrophic bac...

CVSS:

5.3

Affected:

up to 2.1.10

Fixed in:

2.1.11

Disclosed:

Dec 12, 2024

CVE-2024-12579 on NVD →

The Minify HTML plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.1.7. This is due to missing or incorrect nonce validation on the minify_html_menu_options function. This makes it possible for unauthenticated attackers to modify the plugin's settings granted they can t...

CVSS:

4.3

Affected:

up to 2.1.7

Fixed in:

2.1.8

Disclosed:

Feb 21, 2023

CVE-2023-26014 on NVD →