GCVE - cpe:2.3:a:unknown:clearfy_cache:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:unknown:clearfy_cache:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Unknown (`668ca391-a6cc-5e33-879b-83885214de33`)
Product	Clearfy Cache (`8d231447-c89e-5679-a02d-606a4a55466f`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from gcve-enriched-dumps CVE data

PURL mappings

PURL	Source	Last updated
No PURL mappings for this CPE yet.

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2026-16295`	vulnerable	2026-09-16 04:32:57.088006	Clearfy < 2.4.3 - Subscriber+ Sensitive Information Disclosure via Factory Page-Action Dispatcher The Clearfy Cache WordPress plugin before 2.4.3 does not perform a capability check in one of its admin-page dispatch paths, allowing any authenticated user such as a Subscriber to render admin-only settings pages and disclose their contents, including administrative nonces, while the canonical page URL correctly restricts access. Published: 2026-08-04T06:00:12.603Z Updated: 2026-08-04T14:16:50.633Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/ed3e613e-4bb8-45a7-8cfa-4a73aad9abc6/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-16296`	vulnerable	2026-09-16 04:32:56.746443	Clearfy < 2.4.3 - Open Redirect via Cyrlitera 404 Handler The Clearfy Cache WordPress plugin before 2.4.3 does not validate the redirect target in its Cyrlitera old-URL redirect handler, passing a decoded request URI to an unsafe redirect function, which allows unauthenticated attackers to redirect visitors to an arbitrary external URL when a non-default option is enabled. Published: 2026-08-04T06:00:12.778Z Updated: 2026-08-04T14:15:34.714Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/265f2edb-1c86-4b87-a59f-d5de5bf21494/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-16297`	vulnerable	2026-09-16 04:32:56.413415	Clearfy < 2.4.3 - Admin+ PHP Object Injection via Settings Import The Clearfy Cache WordPress plugin before 2.4.3 does not restrict the classes allowed when unserializing settings-import data, allowing users with administrator access to perform PHP Object Injection attacks, which may lead to remote code execution when a suitable gadget chain is present in the environment. Published: 2026-08-03T06:00:13.754Z Updated: 2026-08-03T16:17:31.750Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/3daf62cd-eefe-49ec-89f7-b13f88111853/	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2026-3220`	vulnerable	2026-06-08 08:01:18.193612	Multiple Plugins - Unauthenticated Stored XSS via Minify Library The Autoptimize WordPress plugin before 3.1.15, Clearfy Cache WordPress plugin before 2.4.2, Speed Optimizer WordPress plugin before 7.7.9 are vulnerable to unauthenticated Stored Cross-Site Scripting (XSS) due to a predictable replacement hash used during the HTML minification process and abusing a regular expression. This allows an attacker to inject arbitrary HTML attributes in the final HTML output by anticipating the placeholder format. Published: 2026-05-18T06:00:08.130Z Updated: 2026-05-18T13:40:11.175Z Open on db.gcve.eu Reference links https://wpscan.com/vulnerability/3ceabf11-23cd-4c38-ba14-014348b0ff2d/	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.