Minify HTML
Minify HTML has 3 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 3 are fixed as of September 2026. Their average CVSS score is 5.0, and the most serious one scores 5.4 out of 10.
The most common weakness is Cross-Site Request Forgery (CSRF), behind 2 of the records (67%). Other recurring categories include Uncontrolled Resource Consumption.
Every one of the 3 issues recorded for Minify HTML has a vendor fix available, so running the current release closes all known holes.
3 independent researchers contributed these findings, one record each. Minify HTML is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2026-3191Minify HTML <= 2.1.12 - Cross-Site Request Forgery to Plugin Settings Update
Read the full analysisVulnerability Records
Minify HTML
Author
Tim Eckel
Try it out on a free dummy site here => https://demo.tastewp.com/minify-html-markup Ever look at the HTML markup of your website and notice how sloppy and amateurish it looks? The Minify HTML plugin cleans up sloppy looking markup and minifies, which also speeds up download time. Make your website’s markup look professional by using Minify HTML. Easy to use, simply install and activate (with additional options for advanced settings). Minify HTML also has optional specialized minification for JavaScript and internal CSS. It doesn’t mess with your textareas or preformatted text. Settings options to removes HTML, CSS and JavaScript comments (leaving MSIE conditional comments), remove unneeded XHTML closing tags from HTML5 void elements and remove unneeded relative schemes and domains from links.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C