CVE-2026-13354

HighCVSS 7.2

Published: 19/09/2026(UTC)Updated: 21/09/2026(UTC)Translated: 19/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

16th percentile - higher than 16% of all known CVEs

Summary

The Asset CleanUp: Page Speed Booster plugin for WordPress (versions up to and including 1.4.0.5) is vulnerable to stored cross-site scripting via comment content due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute when a user visits the injected page. This is only exploitable when combine_loaded_css is enabled.

Risk Assessment

Unauthenticated attackers can execute arbitrary JavaScript in a user's browser, potentially leading to session theft or other attacks.

Recommendation

Update the Asset CleanUp plugin to a version newer than 1.4.0.5, or disable it if an update is not possible.

Other vulnerabilities in Asset CleanUp: Page Speed Booster

CVE-2026-66571High
The WordPress plugin Asset CleanUp: Page Speed Booster in versions up to 1.4.0.5 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker can trick a victim into performing unwanted actions.

Original NVD description (English source)

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on instances where combine_loaded_css has been enabled.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS