CVE-2026-13354

Received Received - Intake

Stored XSS in Asset CleanUp Page Speed Booster WordPress Plugin

Publication date: 2026-09-19

Last updated on: 2026-09-19

Assigner: Wordfence

Description

The Asset CleanUp: Page Speed Booster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 1.4.0.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable on instances where combine_loaded_css has been enabled.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-19

Last Modified

2026-09-19

Generated

2026-09-20

AI Q&A

2026-09-20

EPSS Evaluated

N/A

NVD

CVE-2026-13354

Affected Vendors & Products

Vendor	Product	Version / Range
wpbeaverbuilder	asset_cleanup_page_speed_booster	to 1.4.0.5 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-79	The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

Executive Summary

This vulnerability is a Stored Cross-Site Scripting (XSS) flaw in the Asset CleanUp: Page Speed Booster WordPress plugin. It allows unauthenticated attackers to inject malicious scripts into web pages via comment content due to poor input sanitization and output escaping. The scripts execute when users view the affected pages.

Detection Guidance

This vulnerability can be detected by checking if the Asset CleanUp: Page Speed Booster plugin is installed and if its version is up to 1.4.0.5. Inspect WordPress admin pages for suspicious comments or scripts. Review server logs for unusual activity related to the combine_loaded_css feature.

Impact Analysis

Unauthenticated attackers could inject harmful scripts into your website, potentially stealing user data, session cookies, or spreading malware. Visitors to your site may have their accounts compromised or be redirected to malicious sites.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for protecting user data. Organizations may face fines or legal consequences if user data is compromised due to this flaw.

Mitigation Strategies

Immediately update the Asset CleanUp: Page Speed Booster plugin to the latest version. Disable the combine_loaded_css feature if enabled. Remove any suspicious comments or scripts from WordPress pages. Monitor for unauthorized changes or activity.

Hi! I’m here to help you understand CVE-2026-13354. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70