CVE-2026-66571

HighCVSS 7.1

Published: 17/09/2026(UTC)Updated: 17/09/2026(UTC)Translated: 17/09/2026(UTC)NVD NIST

Summary

The WordPress plugin Asset CleanUp: Page Speed Booster in versions up to 1.4.0.5 contains an unauthenticated Cross Site Request Forgery (CSRF) vulnerability. An unauthenticated attacker can trick a victim into performing unwanted actions.

Risk Assessment

An unauthenticated CSRF vulnerability may allow an attacker to perform actions in the context of a logged-in user, potentially leading to unauthorized changes in site configuration. The risk is significant for all installations with this plugin.

Recommendation

Update the Asset CleanUp: Page Speed Booster plugin to a version newer than 1.4.0.5. Consider implementing security headers and CSRF protection mechanisms.

Other vulnerabilities in Asset CleanUp: Page Speed Booster

CVE-2026-13354High
The Asset CleanUp: Page Speed Booster plugin for WordPress (versions up to and including 1.4.0.5) is vulnerable to stored cross-site scripting via comment content due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary scripts that execute when a user visits the injected page. This is only exploitable when combine_loaded_css is enabled.

Original NVD description (English source)

Unauthenticated Cross Site Request Forgery (CSRF) in Asset CleanUp: Page Speed Booster <= 1.4.0.5 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS